Analysis

Common Weaknesses

The most common CWE weakness classes across Erlang ecosystem CVEs

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Viewing · CWE-1340
Switch view
CWE-1340 at MITRE

We're looking at the CWE hierarchy through the CISQ Data Protection Measures view.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): 10 CVEs (28.6%) — click to drill down Improper Access Control: 10 CVEs (28.6%) — click to drill down Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): 5 CVEs (14.3%) — click to drill down Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): 2 CVEs (5.7%) — click to drill down Improper Restriction of Operations within the Bounds of a Memory Buffer: 2 CVEs (5.7%) — click to drill down Deserialization of Untrusted Data: 2 CVEs (5.7%) — click to drill down Improper Restriction of XML External Entity Reference: 1 CVEs (2.9%) — click to drill down Operation on a Resource after Expiration or Release: 1 CVEs (2.9%) — click to drill down Incorrect Conversion between Numeric Types: 1 CVEs (2.9%) — click to drill down Improperly Controlled Modification of Dynamically-Determined Object Attributes: 1 CVEs (2.9%) — click to drill down Improper Neutralization of Special Elements used in a Command ('Command Injection'): 0 CVEs (0.0%) — click to drill down Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'): 0 CVEs (0.0%) — click to drill down XML Injection (aka Blind XPath Injection): 0 CVEs (0.0%) — click to drill down Improper Control of Resource Identifiers ('Resource Injection'): 0 CVEs (0.0%) — click to drill down Improper Validation of Array Index: 0 CVEs (0.0%) — click to drill down Use of Externally-Controlled Format String: 0 CVEs (0.0%) — click to drill down Improper Null Termination: 0 CVEs (0.0%) — click to drill down Exposure of Sensitive Information Due to Incompatible Policies: 0 CVEs (0.0%) — click to drill down Missing Encryption of Sensitive Data: 0 CVEs (0.0%) — click to drill down Exposure of Private Personal Information to an Unauthorized Actor: 0 CVEs (0.0%) — click to drill down Improper Resource Shutdown or Release: 0 CVEs (0.0%) — click to drill down Improper Protection of Alternate Path: 0 CVEs (0.0%) — click to drill down Unrestricted Upload of File with Dangerous Type: 0 CVEs (0.0%) — click to drill down Return of Stack Variable Address: 0 CVEs (0.0%) — click to drill down Unchecked Input for Loop Condition: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Data within XPath Expressions ('XPath Injection'): 0 CVEs (0.0%) — click to drill down Improper Neutralization of Data within XQuery Expressions ('XQuery Injection'): 0 CVEs (0.0%) — click to drill down Improper Synchronization: 0 CVEs (0.0%) — click to drill down Improper Initialization: 0 CVEs (0.0%) — click to drill down Incorrect Calculation: 0 CVEs (0.0%) — click to drill down Improper Check or Handling of Exceptional Conditions: 0 CVEs (0.0%) — click to drill down Incorrect Type Conversion or Cast: 0 CVEs (0.0%) — click to drill down Incorrect Permission Assignment for Critical Resource: 0 CVEs (0.0%) — click to drill down Use of Hard-coded Credentials: 0 CVEs (0.0%) — click to drill down Use of Uninitialized Resource: 0 CVEs (0.0%) — click to drill down Initialization with Hard-Coded Network Resource Configuration Data: 0 CVEs (0.0%) — click to drill down Total 34
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 10 (28.6%) Improper Access Control CWE-284 10 (28.6%) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 5 (14.3%) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-89 2 (5.7%) Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119 2 (5.7%) Deserialization of Untrusted Data CWE-502 2 (5.7%) Improper Restriction of XML External Entity Reference CWE-611 1 (2.9%) Operation on a Resource after Expiration or Release CWE-672 1 (2.9%) Incorrect Conversion between Numeric Types CWE-681 1 (2.9%) Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 1 (2.9%) Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-77 0 (0.0%) Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') CWE-90 0 (0.0%) XML Injection (aka Blind XPath Injection) CWE-91 0 (0.0%) Improper Control of Resource Identifiers ('Resource Injection') CWE-99 0 (0.0%) Improper Validation of Array Index CWE-129 0 (0.0%) Use of Externally-Controlled Format String CWE-134 0 (0.0%) Improper Null Termination CWE-170 0 (0.0%) Exposure of Sensitive Information Due to Incompatible Policies CWE-213 0 (0.0%) Missing Encryption of Sensitive Data CWE-311 0 (0.0%) Exposure of Private Personal Information to an Unauthorized Actor CWE-359 0 (0.0%) Improper Resource Shutdown or Release CWE-404 0 (0.0%) Improper Protection of Alternate Path CWE-424 0 (0.0%) Unrestricted Upload of File with Dangerous Type CWE-434 0 (0.0%) Return of Stack Variable Address CWE-562 0 (0.0%) Unchecked Input for Loop Condition CWE-606 0 (0.0%) Improper Neutralization of Data within XPath Expressions ('XPath Injection') CWE-643 0 (0.0%) Improper Neutralization of Data within XQuery Expressions ('XQuery Injection') CWE-652 0 (0.0%) Improper Synchronization CWE-662 0 (0.0%) Improper Initialization CWE-665 0 (0.0%) Incorrect Calculation CWE-682 0 (0.0%) Improper Check or Handling of Exceptional Conditions CWE-703 0 (0.0%) Incorrect Type Conversion or Cast CWE-704 0 (0.0%) Incorrect Permission Assignment for Critical Resource CWE-732 0 (0.0%) Use of Hard-coded Credentials CWE-798 0 (0.0%) Use of Uninitialized Resource CWE-908 0 (0.0%) Initialization with Hard-Coded Network Resource Configuration Data CWE-1051 0 (0.0%)

CVEs

Every CVE in this view

Summary Publication CVE ID Published
Megaco flex scanner buffer overflow via oversized property parm name
pkg:otp/megaco
pkg:github/erlang/otp
CVE-2026-59250 2026-07-27
Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
pkg:otp/erts
pkg:github/erlang/otp
CVE-2026-55737 2026-07-27
Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
pkg:otp/stdlib
pkg:github/erlang/otp
CVE-2026-47078 2026-07-27
Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
pkg:hex/phoenix_live_view
pkg:github/phoenixframework/phoenix_live_view
CVE-2026-58228 2026-07-13
SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service
pkg:hex/postgrex
pkg:github/elixir-ecto/postgrex
CVE-2026-58225 2026-07-10
Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)
pkg:hex/mdex
pkg:github/leandrocp/mdex
CVE-2026-54889 2026-06-29
Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute
pkg:hex/mdex
pkg:github/leandrocp/mdex
pkg:hex/mdex_native
pkg:github/leandrocp/mdex_native
CVE-2026-53427 2026-06-29
Private action arguments can be set by user input in Ash
pkg:hex/ash
pkg:github/ash-project/ash
CVE-2026-55736 2026-06-23
Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc
pkg:hex/grpc
pkg:github/elixir-grpc/grpc
CVE-2026-48853 2026-06-15
Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding
pkg:hex/grpc
pkg:github/elixir-grpc/grpc
CVE-2026-48599 2026-06-15
Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist
pkg:otp/ssl
pkg:github/erlang/otp
CVE-2026-48860 2026-06-10
Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write
pkg:sid/gleam.run/gleam
pkg:github/gleam-lang/gleam
pkg:oci/gleam
CVE-2026-32685 2026-06-02
Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion
pkg:sid/gleam.run/gleam
pkg:github/gleam-lang/gleam
pkg:oci/gleam
CVE-2026-43965 2026-06-02
OCSP responder certificate validity period not checked in public_key
pkg:otp/public_key
pkg:github/erlang/otp
CVE-2026-42791 2026-05-27
Missing authorization check on save-job event handler in oban_web
pkg:hex/oban_web
pkg:github/oban-bg/oban_web
CVE-2026-48592 2026-05-26
Cross-session PubSub topic injection via URL parameter in phoenix_storybook
pkg:hex/phoenix_storybook
pkg:github/phenixdigital/phoenix_storybook
CVE-2026-47068 2026-05-20
SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3
pkg:hex/postgrex
pkg:github/elixir-ecto/postgrex
CVE-2026-32687 2026-05-12
Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug
pkg:hex/absinthe_plug
pkg:github/absinthe-graphql/absinthe_plug
CVE-2026-42794 2026-05-08
SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT
pkg:otp/ssh
pkg:github/erlang/otp
CVE-2026-32147 2026-04-21
Improper Path Validation in Git Dependency Handling Allows Arbitrary File System Modification
pkg:sid/gleam.run/gleam
pkg:github/gleam-lang/gleam
pkg:oci/gleam
CVE-2026-32146 2026-04-11
ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)
pkg:otp/inets
pkg:github/erlang/otp
CVE-2026-28808 2026-04-07
XXE in esaml SAML library allows local file read and potential SSRF
pkg:hex/esaml
pkg:github/arekinath/esaml
pkg:github/handnot2/esaml
pkg:github/dropbox/esaml
pkg:github/jump-app/esaml
CVE-2026-28809 2026-03-23
SFTP root escape via component-agnostic prefix check in ssh_sftpd
pkg:otp/ssh
pkg:github/erlang/otp
CVE-2026-23942 2026-03-13
Path Traversal in wisp.serve_static allows arbitrary file read
pkg:hex/wisp
pkg:github/gleam-wisp/wisp
CVE-2026-28807 2026-03-10
Improper authorization in device bulk actions and device update API allows cross-organization device control
pkg:otp/nerves_hub
pkg:oci/nerves-hub
pkg:github/nerves-hub/nerves_hub_web
CVE-2026-28806 2026-03-10
25 per page · 34 CVEs
Page of 2