Analysis

Common Weaknesses

The most common CWE weakness classes across Erlang ecosystem CVEs

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Viewing · CWE-1337
Switch view
CWE-1337 at MITRE

We're looking at the CWE hierarchy through the Weaknesses in the 2021 CWE Top 25 Most Dangerous Software Weaknesses view.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): 8 CVEs (32.0%) — click to drill down Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): 5 CVEs (20.0%) — click to drill down Server-Side Request Forgery (SSRF): 3 CVEs (12.0%) — click to drill down Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): 2 CVEs (8.0%) — click to drill down Deserialization of Untrusted Data: 2 CVEs (8.0%) — click to drill down Out-of-bounds Write: 2 CVEs (8.0%) — click to drill down Exposure of Sensitive Information to an Unauthorized Actor: 1 CVEs (4.0%) — click to drill down Improper Restriction of XML External Entity Reference: 1 CVEs (4.0%) — click to drill down Missing Authorization: 1 CVEs (4.0%) — click to drill down Improper Input Validation: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Special Elements used in a Command ('Command Injection'): 0 CVEs (0.0%) — click to drill down Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): 0 CVEs (0.0%) — click to drill down Improper Restriction of Operations within the Bounds of a Memory Buffer: 0 CVEs (0.0%) — click to drill down Out-of-bounds Read: 0 CVEs (0.0%) — click to drill down Integer Overflow or Wraparound: 0 CVEs (0.0%) — click to drill down Incorrect Default Permissions: 0 CVEs (0.0%) — click to drill down Improper Authentication: 0 CVEs (0.0%) — click to drill down Missing Authentication for Critical Function: 0 CVEs (0.0%) — click to drill down Cross-Site Request Forgery (CSRF): 0 CVEs (0.0%) — click to drill down Use After Free: 0 CVEs (0.0%) — click to drill down Unrestricted Upload of File with Dangerous Type: 0 CVEs (0.0%) — click to drill down NULL Pointer Dereference: 0 CVEs (0.0%) — click to drill down Insufficiently Protected Credentials: 0 CVEs (0.0%) — click to drill down Incorrect Permission Assignment for Critical Resource: 0 CVEs (0.0%) — click to drill down Use of Hard-coded Credentials: 0 CVEs (0.0%) — click to drill down Total 25
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 8 (32.0%) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 5 (20.0%) Server-Side Request Forgery (SSRF) CWE-918 3 (12.0%) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-89 2 (8.0%) Deserialization of Untrusted Data CWE-502 2 (8.0%) Out-of-bounds Write CWE-787 2 (8.0%) Exposure of Sensitive Information to an Unauthorized Actor CWE-200 1 (4.0%) Improper Restriction of XML External Entity Reference CWE-611 1 (4.0%) Missing Authorization CWE-862 1 (4.0%) Improper Input Validation CWE-20 0 (0.0%) Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-77 0 (0.0%) Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78 0 (0.0%) Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119 0 (0.0%) Out-of-bounds Read CWE-125 0 (0.0%) Integer Overflow or Wraparound CWE-190 0 (0.0%) Incorrect Default Permissions CWE-276 0 (0.0%) Improper Authentication CWE-287 0 (0.0%) Missing Authentication for Critical Function CWE-306 0 (0.0%) Cross-Site Request Forgery (CSRF) CWE-352 0 (0.0%) Use After Free CWE-416 0 (0.0%) Unrestricted Upload of File with Dangerous Type CWE-434 0 (0.0%) NULL Pointer Dereference CWE-476 0 (0.0%) Insufficiently Protected Credentials CWE-522 0 (0.0%) Incorrect Permission Assignment for Critical Resource CWE-732 0 (0.0%) Use of Hard-coded Credentials CWE-798 0 (0.0%)

CVEs

Every CVE in this view

Summary Publication CVE ID Published
Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
pkg:hex/boruta
pkg:github/malach-it/boruta_auth
CVE-2026-54885 2026-07-30
Megaco flex scanner buffer overflow via oversized property parm name
pkg:otp/megaco
pkg:github/erlang/otp
CVE-2026-59250 2026-07-27
Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
pkg:otp/erts
pkg:github/erlang/otp
CVE-2026-55737 2026-07-27
Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
pkg:hex/phoenix_live_view
pkg:github/phoenixframework/phoenix_live_view
CVE-2026-58228 2026-07-13
SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service
pkg:hex/postgrex
pkg:github/elixir-ecto/postgrex
CVE-2026-58225 2026-07-10
Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)
pkg:hex/mdex
pkg:github/leandrocp/mdex
CVE-2026-54889 2026-06-29
Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute
pkg:hex/mdex
pkg:github/leandrocp/mdex
pkg:hex/mdex_native
pkg:github/leandrocp/mdex_native
CVE-2026-53427 2026-06-29
Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc
pkg:hex/grpc
pkg:github/elixir-grpc/grpc
CVE-2026-48853 2026-06-15
SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured
pkg:otp/ssh
pkg:github/erlang/otp
CVE-2026-48855 2026-06-10
ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks
pkg:otp/inets
pkg:otp/ftp
pkg:github/erlang/otp
CVE-2026-48858 2026-06-10
Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write
pkg:sid/gleam.run/gleam
pkg:github/gleam-lang/gleam
pkg:oci/gleam
CVE-2026-32685 2026-06-02
Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion
pkg:sid/gleam.run/gleam
pkg:github/gleam-lang/gleam
pkg:oci/gleam
CVE-2026-43965 2026-06-02
Missing authorization check on save-job event handler in oban_web
pkg:hex/oban_web
pkg:github/oban-bg/oban_web
CVE-2026-48592 2026-05-26
SSRF allowlist bypass via percent-encoded host in hackney
pkg:hex/hackney
pkg:github/benoitc/hackney
CVE-2026-47076 2026-05-25
SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3
pkg:hex/postgrex
pkg:github/elixir-ecto/postgrex
CVE-2026-32687 2026-05-12
Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug
pkg:hex/absinthe_plug
pkg:github/absinthe-graphql/absinthe_plug
CVE-2026-42794 2026-05-08
SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT
pkg:otp/ssh
pkg:github/erlang/otp
CVE-2026-32147 2026-04-21
Improper Path Validation in Git Dependency Handling Allows Arbitrary File System Modification
pkg:sid/gleam.run/gleam
pkg:github/gleam-lang/gleam
pkg:oci/gleam
CVE-2026-32146 2026-04-11
XXE in esaml SAML library allows local file read and potential SSRF
pkg:hex/esaml
pkg:github/arekinath/esaml
pkg:github/handnot2/esaml
pkg:github/dropbox/esaml
pkg:github/jump-app/esaml
CVE-2026-28809 2026-03-23
SFTP root escape via component-agnostic prefix check in ssh_sftpd
pkg:otp/ssh
pkg:github/erlang/otp
CVE-2026-23942 2026-03-13
Path Traversal in wisp.serve_static allows arbitrary file read
pkg:hex/wisp
pkg:github/gleam-wisp/wisp
CVE-2026-28807 2026-03-10
Unsafe Deserialization of Erlang Terms in hex_core
pkg:github/hexpm/hex_core
pkg:hex/hex_core
pkg:github/hexpm/hex
pkg:otp/hex
pkg:github/erlang/rebar3
pkg:otp/rebar3
CVE-2026-21619 2026-02-27
Path Traversal in Local File Store Backend
pkg:github/hexpm/hexpm
CVE-2026-23939 2026-02-26
Cross-site scripting (XSS) in OAuth Device Authorization screen
pkg:github/hexpm/hexpm
CVE-2026-21618 2026-01-19
Absolute path traversal in zip:unzip/1,2
pkg:otp/stdlib
pkg:github/erlang/otp
CVE-2025-4748 2025-06-16
25 CVEs