Analysis

Common Weaknesses

The most common CWE weakness classes across Erlang ecosystem CVEs

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Improper Adherence to Coding Standards CWE-710 CWE-710 at MITRE

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

Improper Following of Specification by Caller: 1 CVEs (50.0%) — click to drill down Violation of Secure Design Principles: 1 CVEs (50.0%) — click to drill down NULL Pointer Dereference: 0 CVEs (0.0%) — click to drill down Use of Obsolete Function: 0 CVEs (0.0%) — click to drill down Omitted Break Statement in Switch: 0 CVEs (0.0%) — click to drill down Active Debug Code: 0 CVEs (0.0%) — click to drill down Expression is Always False: 0 CVEs (0.0%) — click to drill down Expression is Always True: 0 CVEs (0.0%) — click to drill down Incorrect Provision of Specified Functionality: 0 CVEs (0.0%) — click to drill down Reliance on Undefined, Unspecified, or Implementation-Defined Behavior: 0 CVEs (0.0%) — click to drill down Use of Redundant Code: 0 CVEs (0.0%) — click to drill down Architecture with Number of Horizontal Layers Outside of Expected Range: 0 CVEs (0.0%) — click to drill down Invokable Control Element with Large Number of Outward Calls: 0 CVEs (0.0%) — click to drill down Insufficient Technical Documentation: 0 CVEs (0.0%) — click to drill down Insufficient Encapsulation: 0 CVEs (0.0%) — click to drill down Runtime Resource Management Control Element in a Component Built to Run on Application Servers: 0 CVEs (0.0%) — click to drill down Missing Serialization Control Element: 0 CVEs (0.0%) — click to drill down Inconsistency Between Implementation and Documented Design: 0 CVEs (0.0%) — click to drill down Insufficient Adherence to Expected Conventions: 0 CVEs (0.0%) — click to drill down Use of Same Invokable Control Element in Multiple Architectural Layers: 0 CVEs (0.0%) — click to drill down Excessively Complex Data Representation: 0 CVEs (0.0%) — click to drill down Reliance on Runtime Component in Generated Code: 0 CVEs (0.0%) — click to drill down Excessive Code Complexity: 0 CVEs (0.0%) — click to drill down Declaration of Variable with Unnecessarily Wide Scope: 0 CVEs (0.0%) — click to drill down Compilation with Insufficient Warnings or Errors: 0 CVEs (0.0%) — click to drill down Irrelevant Code: 0 CVEs (0.0%) — click to drill down Use of Prohibited Code: 0 CVEs (0.0%) — click to drill down Failure to Disable Reserved Bits: 0 CVEs (0.0%) — click to drill down Reliance on Insufficiently Trustworthy Component: 0 CVEs (0.0%) — click to drill down Total 2
Improper Following of Specification by Caller CWE-573 1 (50.0%) Violation of Secure Design Principles CWE-657 1 (50.0%) NULL Pointer Dereference CWE-476 0 (0.0%) Use of Obsolete Function CWE-477 0 (0.0%) Omitted Break Statement in Switch CWE-484 0 (0.0%) Active Debug Code CWE-489 0 (0.0%) Expression is Always False CWE-570 0 (0.0%) Expression is Always True CWE-571 0 (0.0%) Incorrect Provision of Specified Functionality CWE-684 0 (0.0%) Reliance on Undefined, Unspecified, or Implementation-Defined Behavior CWE-758 0 (0.0%) Use of Redundant Code CWE-1041 0 (0.0%) Architecture with Number of Horizontal Layers Outside of Expected Range CWE-1044 0 (0.0%) Invokable Control Element with Large Number of Outward Calls CWE-1048 0 (0.0%) Insufficient Technical Documentation CWE-1059 0 (0.0%) Insufficient Encapsulation CWE-1061 0 (0.0%) Runtime Resource Management Control Element in a Component Built to Run on Application Servers CWE-1065 0 (0.0%) Missing Serialization Control Element CWE-1066 0 (0.0%) Inconsistency Between Implementation and Documented Design CWE-1068 0 (0.0%) Insufficient Adherence to Expected Conventions CWE-1076 0 (0.0%) Use of Same Invokable Control Element in Multiple Architectural Layers CWE-1092 0 (0.0%) Excessively Complex Data Representation CWE-1093 0 (0.0%) Reliance on Runtime Component in Generated Code CWE-1101 0 (0.0%) Excessive Code Complexity CWE-1120 0 (0.0%) Declaration of Variable with Unnecessarily Wide Scope CWE-1126 0 (0.0%) Compilation with Insufficient Warnings or Errors CWE-1127 0 (0.0%) Irrelevant Code CWE-1164 0 (0.0%) Use of Prohibited Code CWE-1177 0 (0.0%) Failure to Disable Reserved Bits CWE-1209 0 (0.0%) Reliance on Insufficiently Trustworthy Component CWE-1357 0 (0.0%)

CVEs

CVEs for Improper Adherence to Coding Standards CWE-710

Summary Publication CVE ID Published
Boruta dynamic client registration allows creation of over-privileged OAuth clients
pkg:hex/boruta
pkg:github/malach-it/boruta_auth
CVE-2026-65635 2026-07-30
Non-CA certificate accepted as intermediate issuer in public_key path validation
pkg:otp/public_key
pkg:github/erlang/otp
CVE-2026-42789 2026-05-27
2 CVEs