Hex.pm
Hexpm · 3 CVEs
CVE-2026-21622
CRITICAL
Password Reset Tokens Do Not Expire
Mar 5, 2026
CVE-2026-21621
HIGH
Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access
Mar 5, 2026
CVE-2026-21618
HIGH
Cross-site scripting (XSS) in OAuth Device Authorization screen
Jan 19, 2026
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-21622 | Password Reset Tokens Do Not Expire | CRITICAL | 0.40% | Mar 5, 2026 |
| CVE-2026-21621 | Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access | HIGH | 0.34% | Mar 5, 2026 |
| CVE-2026-21618 | Cross-site scripting (XSS) in OAuth Device Authorization screen | HIGH | 0.26% | Jan 19, 2026 |
Showing 1 to 3 of 3 CVEs