The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Improper Neutralization of Special Elements CWE-138 CWE-138 at MITRE

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

Improper Neutralization of Delimiters: 1 CVEs (100.0%) — click to drill down Improper Neutralization of Input Terminators: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Input Leaders: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Quoting Syntax: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Escape, Meta, or Control Sequences: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Comment Delimiters: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Macro Symbols: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Substitution Characters: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Variable Name Delimiters: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Wildcards or Matching Symbols: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Whitespace: 0 CVEs (0.0%) — click to drill down Failure to Sanitize Paired Delimiters: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Null Byte or NUL Character: 0 CVEs (0.0%) — click to drill down Improper Handling of Invalid Use of Special Elements: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Leading Special Elements: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Trailing Special Elements: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Internal Special Elements: 0 CVEs (0.0%) — click to drill down Addition of Data Structure Sentinel: 0 CVEs (0.0%) — click to drill down Improper Filtering of Special Elements: 0 CVEs (0.0%) — click to drill down Total 1

CVEs

CVEs for Improper Neutralization of Special Elements CWE-138

Summary Publication CVE ID Published
Cookie attribute injection in Plug.Conn.Cookies.encode/2 CVE-2026-56813 2026-07-10
1 CVE