Analysis

Common Weaknesses

The most common CWE weakness classes across Erlang ecosystem CVEs

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Viewing · CWE-884
Switch view
CWE-884 at MITRE

We're looking at the CWE hierarchy through the CWE Cross-section view.

Allocation of Resources Without Limits or Throttling: 33 CVEs (30.3%) — click to drill down Uncontrolled Resource Consumption: 14 CVEs (12.8%) — click to drill down Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): 8 CVEs (7.3%) — click to drill down Incorrect Authorization: 6 CVEs (5.5%) — click to drill down Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): 5 CVEs (4.6%) — click to drill down Improper Handling of Highly Compressed Data (Data Amplification): 5 CVEs (4.6%) — click to drill down Inefficient Algorithmic Complexity: 4 CVEs (3.7%) — click to drill down Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'): 4 CVEs (3.7%) — click to drill down Loop with Unreachable Exit Condition ('Infinite Loop'): 3 CVEs (2.8%) — click to drill down Relative Path Traversal: 2 CVEs (1.8%) — click to drill down Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): 2 CVEs (1.8%) — click to drill down Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'): 2 CVEs (1.8%) — click to drill down Authentication Bypass by Spoofing: 2 CVEs (1.8%) — click to drill down Deserialization of Untrusted Data: 2 CVEs (1.8%) — click to drill down URL Redirection to Untrusted Site ('Open Redirect'): 2 CVEs (1.8%) — click to drill down Uncontrolled Recursion: 2 CVEs (1.8%) — click to drill down Improper Link Resolution Before File Access ('Link Following'): 1 CVEs (0.9%) — click to drill down Improper Control of Generation of Code ('Code Injection'): 1 CVEs (0.9%) — click to drill down Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'): 1 CVEs (0.9%) — click to drill down Integer Underflow (Wrap or Wraparound): 1 CVEs (0.9%) — click to drill down Authentication Bypass by Capture-replay: 1 CVEs (0.9%) — click to drill down Improper Following of a Certificate's Chain of Trust: 1 CVEs (0.9%) — click to drill down Improper Validation of Integrity Check Value: 1 CVEs (0.9%) — click to drill down Time-of-check Time-of-use (TOCTOU) Race Condition: 1 CVEs (0.9%) — click to drill down Download of Code Without Integrity Check: 1 CVEs (0.9%) — click to drill down Operation on a Resource after Expiration or Release: 1 CVEs (0.9%) — click to drill down Reliance on Untrusted Inputs in a Security Decision: 1 CVEs (0.9%) — click to drill down Improper Enforcement of Behavioral Workflow: 1 CVEs (0.9%) — click to drill down Missing Authorization: 1 CVEs (0.9%) — click to drill down Compiler Removal of Code to Clear Buffers: 0 CVEs (0.0%) — click to drill down Absolute Path Traversal: 0 CVEs (0.0%) — click to drill down Improper Resolution of Path Equivalence: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): 0 CVEs (0.0%) — click to drill down Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'): 0 CVEs (0.0%) — click to drill down Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'): 0 CVEs (0.0%) — click to drill down Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'): 0 CVEs (0.0%) — click to drill down Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection'): 0 CVEs (0.0%) — click to drill down Improper Control of Resource Identifiers ('Resource Injection'): 0 CVEs (0.0%) — click to drill down Improper Output Neutralization for Logs: 0 CVEs (0.0%) — click to drill down Improper Validation of Array Index: 0 CVEs (0.0%) — click to drill down Incorrect Calculation of Buffer Size: 0 CVEs (0.0%) — click to drill down Use of Externally-Controlled Format String: 0 CVEs (0.0%) — click to drill down Incorrect Calculation of Multi-Byte String Length: 0 CVEs (0.0%) — click to drill down Improper Null Termination: 0 CVEs (0.0%) — click to drill down Improper Handling of Alternate Encoding: 0 CVEs (0.0%) — click to drill down Double Decoding of the Same Data: 0 CVEs (0.0%) — click to drill down Improper Handling of Mixed Encoding: 0 CVEs (0.0%) — click to drill down Incorrect Behavior Order: Early Validation: 0 CVEs (0.0%) — click to drill down Incorrect Regular Expression: 0 CVEs (0.0%) — click to drill down Integer Overflow or Wraparound: 0 CVEs (0.0%) — click to drill down Off-by-one Error: 0 CVEs (0.0%) — click to drill down Observable Discrepancy: 0 CVEs (0.0%) — click to drill down Generation of Error Message Containing Sensitive Information: 0 CVEs (0.0%) — click to drill down Improper Removal of Sensitive Information Before Storage or Transfer: 0 CVEs (0.0%) — click to drill down Truncation of Security-relevant Information: 0 CVEs (0.0%) — click to drill down Omission of Security-relevant Information: 0 CVEs (0.0%) — click to drill down Improper Handling of Syntactically Invalid Structure: 0 CVEs (0.0%) — click to drill down Improper Clearing of Heap Memory Before Release ('Heap Inspection'): 0 CVEs (0.0%) — click to drill down Uncaught Exception: 0 CVEs (0.0%) — click to drill down Execution with Unnecessary Privileges: 0 CVEs (0.0%) — click to drill down Unchecked Return Value: 0 CVEs (0.0%) — click to drill down Incorrect Check of Function Return Value: 0 CVEs (0.0%) — click to drill down Not Using Password Aging: 0 CVEs (0.0%) — click to drill down Password Aging with Long Expiration: 0 CVEs (0.0%) — click to drill down Incorrect Privilege Assignment: 0 CVEs (0.0%) — click to drill down Privilege Defined With Unsafe Actions: 0 CVEs (0.0%) — click to drill down Privilege Chaining: 0 CVEs (0.0%) — click to drill down Privilege Context Switching Error: 0 CVEs (0.0%) — click to drill down Privilege Dropping / Lowering Errors: 0 CVEs (0.0%) — click to drill down Improper Check for Dropped Privileges: 0 CVEs (0.0%) — click to drill down Unverified Ownership: 0 CVEs (0.0%) — click to drill down Improper Check for Certificate Revocation: 0 CVEs (0.0%) — click to drill down Channel Accessible by Non-Endpoint: 0 CVEs (0.0%) — click to drill down Reflection Attack in an Authentication Protocol: 0 CVEs (0.0%) — click to drill down Missing Critical Step in Authentication: 0 CVEs (0.0%) — click to drill down Missing Authentication for Critical Function: 0 CVEs (0.0%) — click to drill down Improper Restriction of Excessive Authentication Attempts: 0 CVEs (0.0%) — click to drill down Use of Single-factor Authentication: 0 CVEs (0.0%) — click to drill down Cleartext Storage of Sensitive Information: 0 CVEs (0.0%) — click to drill down Cleartext Transmission of Sensitive Information: 0 CVEs (0.0%) — click to drill down Key Exchange without Entity Authentication: 0 CVEs (0.0%) — click to drill down Reusing a Nonce, Key Pair in Encryption: 0 CVEs (0.0%) — click to drill down Missing Cryptographic Step: 0 CVEs (0.0%) — click to drill down Use of a Broken or Risky Cryptographic Algorithm: 0 CVEs (0.0%) — click to drill down Insufficient Entropy: 0 CVEs (0.0%) — click to drill down Small Space of Random Values: 0 CVEs (0.0%) — click to drill down Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG): 0 CVEs (0.0%) — click to drill down Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG): 0 CVEs (0.0%) — click to drill down Predictable from Observable State: 0 CVEs (0.0%) — click to drill down Improper Verification of Cryptographic Signature: 0 CVEs (0.0%) — click to drill down Use of Less Trusted Source: 0 CVEs (0.0%) — click to drill down Acceptance of Extraneous Untrusted Data With Trusted Data: 0 CVEs (0.0%) — click to drill down Cross-Site Request Forgery (CSRF): 0 CVEs (0.0%) — click to drill down Missing Support for Integrity Check: 0 CVEs (0.0%) — click to drill down Signal Handler Race Condition: 0 CVEs (0.0%) — click to drill down Divide By Zero: 0 CVEs (0.0%) — click to drill down Detection of Error Condition Without Action: 0 CVEs (0.0%) — click to drill down Missing Report of Error Condition: 0 CVEs (0.0%) — click to drill down Return of Wrong Status Code: 0 CVEs (0.0%) — click to drill down Insufficient Control of Network Message Volume (Network Amplification): 0 CVEs (0.0%) — click to drill down Incorrect Behavior Order: Early Amplification: 0 CVEs (0.0%) — click to drill down Unrestricted Upload of File with Dangerous Type: 0 CVEs (0.0%) — click to drill down User Interface (UI) Misrepresentation of Critical Information: 0 CVEs (0.0%) — click to drill down Insecure Default Variable Initialization: 0 CVEs (0.0%) — click to drill down External Initialization of Trusted Variables or Data Stores: 0 CVEs (0.0%) — click to drill down Non-exit on Failed Initialization: 0 CVEs (0.0%) — click to drill down Missing Initialization of a Variable: 0 CVEs (0.0%) — click to drill down Use of sizeof() on a Pointer Type: 0 CVEs (0.0%) — click to drill down Incorrect Pointer Scaling: 0 CVEs (0.0%) — click to drill down Use of Pointer Subtraction to Determine Size: 0 CVEs (0.0%) — click to drill down Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'): 0 CVEs (0.0%) — click to drill down NULL Pointer Dereference: 0 CVEs (0.0%) — click to drill down Missing Default Case in Multiple Condition Expression: 0 CVEs (0.0%) — click to drill down Use of Incorrect Operator: 0 CVEs (0.0%) — click to drill down Incorrect Block Delimitation: 0 CVEs (0.0%) — click to drill down Omitted Break Statement in Switch: 0 CVEs (0.0%) — click to drill down Comparison of Classes by Name: 0 CVEs (0.0%) — click to drill down Private Data Structure Returned From A Public Method: 0 CVEs (0.0%) — click to drill down Public Data Assigned to Private Array-Typed Field: 0 CVEs (0.0%) — click to drill down Cloneable Class Containing Sensitive Information: 0 CVEs (0.0%) — click to drill down Serializable Class Containing Sensitive Data: 0 CVEs (0.0%) — click to drill down Weak Password Requirements: 0 CVEs (0.0%) — click to drill down Insufficiently Protected Credentials: 0 CVEs (0.0%) — click to drill down Suspicious Comment: 0 CVEs (0.0%) — click to drill down Use of Hard-coded, Security-relevant Constants: 0 CVEs (0.0%) — click to drill down Dead Code: 0 CVEs (0.0%) — click to drill down Assignment to Variable without Use: 0 CVEs (0.0%) — click to drill down Unsynchronized Access to Shared Data in a Multithreaded Context: 0 CVEs (0.0%) — click to drill down Assignment of a Fixed Address to a Pointer: 0 CVEs (0.0%) — click to drill down Comparison of Object References Instead of Object Contents: 0 CVEs (0.0%) — click to drill down Client-Side Enforcement of Server-Side Security: 0 CVEs (0.0%) — click to drill down Multiple Binds to the Same Port: 0 CVEs (0.0%) — click to drill down Reachable Assertion: 0 CVEs (0.0%) — click to drill down Variable Extraction Error: 0 CVEs (0.0%) — click to drill down Dynamic Variable Evaluation: 0 CVEs (0.0%) — click to drill down Function Call with Incorrectly Specified Arguments: 0 CVEs (0.0%) — click to drill down External Control of Critical State Data: 0 CVEs (0.0%) — click to drill down Incorrect Use of Privileged APIs: 0 CVEs (0.0%) — click to drill down Improper Locking: 0 CVEs (0.0%) — click to drill down Use of Potentially Dangerous Function: 0 CVEs (0.0%) — click to drill down Incorrect Conversion between Numeric Types: 0 CVEs (0.0%) — click to drill down Execution After Redirect (EAR): 0 CVEs (0.0%) — click to drill down Incorrect Ownership Assignment: 0 CVEs (0.0%) — click to drill down Incorrect Permission Assignment for Critical Resource: 0 CVEs (0.0%) — click to drill down Missing Custom Error Page: 0 CVEs (0.0%) — click to drill down Release of Invalid Pointer or Reference: 0 CVEs (0.0%) — click to drill down Missing Release of Resource after Effective Lifetime: 0 CVEs (0.0%) — click to drill down Operator Precedence Logic Error: 0 CVEs (0.0%) — click to drill down Access of Memory Location Before Start of Buffer: 0 CVEs (0.0%) — click to drill down Access of Memory Location After End of Buffer: 0 CVEs (0.0%) — click to drill down Use of Hard-coded Credentials: 0 CVEs (0.0%) — click to drill down Buffer Access with Incorrect Length Value: 0 CVEs (0.0%) — click to drill down Untrusted Pointer Dereference: 0 CVEs (0.0%) — click to drill down Expired Pointer Dereference: 0 CVEs (0.0%) — click to drill down Inclusion of Functionality from Untrusted Control Sphere: 0 CVEs (0.0%) — click to drill down Inappropriate Encoding for Output Context: 0 CVEs (0.0%) — click to drill down Numeric Range Comparison Without Minimum Check: 0 CVEs (0.0%) — click to drill down Total 101
Allocation of Resources Without Limits or Throttling CWE-770 33 (30.3%) Uncontrolled Resource Consumption CWE-400 14 (12.8%) Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 8 (7.3%) Incorrect Authorization CWE-863 6 (5.5%) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 5 (4.6%) Improper Handling of Highly Compressed Data (Data Amplification) CWE-409 5 (4.6%) Inefficient Algorithmic Complexity CWE-407 4 (3.7%) Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CWE-444 4 (3.7%) Loop with Unreachable Exit Condition ('Infinite Loop') CWE-835 3 (2.8%) Relative Path Traversal CWE-23 2 (1.8%) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-89 2 (1.8%) Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') CWE-113 2 (1.8%) Authentication Bypass by Spoofing CWE-290 2 (1.8%) Deserialization of Untrusted Data CWE-502 2 (1.8%) URL Redirection to Untrusted Site ('Open Redirect') CWE-601 2 (1.8%) Uncontrolled Recursion CWE-674 2 (1.8%) Improper Link Resolution Before File Access ('Link Following') CWE-59 1 (0.9%) Improper Control of Generation of Code ('Code Injection') CWE-94 1 (0.9%) Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-120 1 (0.9%) Integer Underflow (Wrap or Wraparound) CWE-191 1 (0.9%) Authentication Bypass by Capture-replay CWE-294 1 (0.9%) Improper Following of a Certificate's Chain of Trust CWE-296 1 (0.9%) Improper Validation of Integrity Check Value CWE-354 1 (0.9%) Time-of-check Time-of-use (TOCTOU) Race Condition CWE-367 1 (0.9%) Download of Code Without Integrity Check CWE-494 1 (0.9%) Operation on a Resource after Expiration or Release CWE-672 1 (0.9%) Reliance on Untrusted Inputs in a Security Decision CWE-807 1 (0.9%) Improper Enforcement of Behavioral Workflow CWE-841 1 (0.9%) Missing Authorization CWE-862 1 (0.9%) Compiler Removal of Code to Clear Buffers CWE-14 0 (0.0%) Absolute Path Traversal CWE-36 0 (0.0%) Improper Resolution of Path Equivalence CWE-41 0 (0.0%) Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78 0 (0.0%) Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') CWE-88 0 (0.0%) Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') CWE-90 0 (0.0%) Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') CWE-95 0 (0.0%) Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') CWE-96 0 (0.0%) Improper Control of Resource Identifiers ('Resource Injection') CWE-99 0 (0.0%) Improper Output Neutralization for Logs CWE-117 0 (0.0%) Improper Validation of Array Index CWE-129 0 (0.0%) Incorrect Calculation of Buffer Size CWE-131 0 (0.0%) Use of Externally-Controlled Format String CWE-134 0 (0.0%) Incorrect Calculation of Multi-Byte String Length CWE-135 0 (0.0%) Improper Null Termination CWE-170 0 (0.0%) Improper Handling of Alternate Encoding CWE-173 0 (0.0%) Double Decoding of the Same Data CWE-174 0 (0.0%) Improper Handling of Mixed Encoding CWE-175 0 (0.0%) Incorrect Behavior Order: Early Validation CWE-179 0 (0.0%) Incorrect Regular Expression CWE-185 0 (0.0%) Integer Overflow or Wraparound CWE-190 0 (0.0%) Off-by-one Error CWE-193 0 (0.0%) Observable Discrepancy CWE-203 0 (0.0%) Generation of Error Message Containing Sensitive Information CWE-209 0 (0.0%) Improper Removal of Sensitive Information Before Storage or Transfer CWE-212 0 (0.0%) Truncation of Security-relevant Information CWE-222 0 (0.0%) Omission of Security-relevant Information CWE-223 0 (0.0%) Improper Handling of Syntactically Invalid Structure CWE-228 0 (0.0%) Improper Clearing of Heap Memory Before Release ('Heap Inspection') CWE-244 0 (0.0%) Uncaught Exception CWE-248 0 (0.0%) Execution with Unnecessary Privileges CWE-250 0 (0.0%) Unchecked Return Value CWE-252 0 (0.0%) Incorrect Check of Function Return Value CWE-253 0 (0.0%) Not Using Password Aging CWE-262 0 (0.0%) Password Aging with Long Expiration CWE-263 0 (0.0%) Incorrect Privilege Assignment CWE-266 0 (0.0%) Privilege Defined With Unsafe Actions CWE-267 0 (0.0%) Privilege Chaining CWE-268 0 (0.0%) Privilege Context Switching Error CWE-270 0 (0.0%) Privilege Dropping / Lowering Errors CWE-271 0 (0.0%) Improper Check for Dropped Privileges CWE-273 0 (0.0%) Unverified Ownership CWE-283 0 (0.0%) Improper Check for Certificate Revocation CWE-299 0 (0.0%) Channel Accessible by Non-Endpoint CWE-300 0 (0.0%) Reflection Attack in an Authentication Protocol CWE-301 0 (0.0%) Missing Critical Step in Authentication CWE-304 0 (0.0%) Missing Authentication for Critical Function CWE-306 0 (0.0%) Improper Restriction of Excessive Authentication Attempts CWE-307 0 (0.0%) Use of Single-factor Authentication CWE-308 0 (0.0%) Cleartext Storage of Sensitive Information CWE-312 0 (0.0%) Cleartext Transmission of Sensitive Information CWE-319 0 (0.0%) Key Exchange without Entity Authentication CWE-322 0 (0.0%) Reusing a Nonce, Key Pair in Encryption CWE-323 0 (0.0%) Missing Cryptographic Step CWE-325 0 (0.0%) Use of a Broken or Risky Cryptographic Algorithm CWE-327 0 (0.0%) Insufficient Entropy CWE-331 0 (0.0%) Small Space of Random Values CWE-334 0 (0.0%) Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) CWE-335 0 (0.0%) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) CWE-338 0 (0.0%) Predictable from Observable State CWE-341 0 (0.0%) Improper Verification of Cryptographic Signature CWE-347 0 (0.0%) Use of Less Trusted Source CWE-348 0 (0.0%) Acceptance of Extraneous Untrusted Data With Trusted Data CWE-349 0 (0.0%) Cross-Site Request Forgery (CSRF) CWE-352 0 (0.0%) Missing Support for Integrity Check CWE-353 0 (0.0%) Signal Handler Race Condition CWE-364 0 (0.0%) Divide By Zero CWE-369 0 (0.0%) Detection of Error Condition Without Action CWE-390 0 (0.0%) Missing Report of Error Condition CWE-392 0 (0.0%) Return of Wrong Status Code CWE-393 0 (0.0%) Insufficient Control of Network Message Volume (Network Amplification) CWE-406 0 (0.0%) Incorrect Behavior Order: Early Amplification CWE-408 0 (0.0%) Unrestricted Upload of File with Dangerous Type CWE-434 0 (0.0%) User Interface (UI) Misrepresentation of Critical Information CWE-451 0 (0.0%) Insecure Default Variable Initialization CWE-453 0 (0.0%) External Initialization of Trusted Variables or Data Stores CWE-454 0 (0.0%) Non-exit on Failed Initialization CWE-455 0 (0.0%) Missing Initialization of a Variable CWE-456 0 (0.0%) Use of sizeof() on a Pointer Type CWE-467 0 (0.0%) Incorrect Pointer Scaling CWE-468 0 (0.0%) Use of Pointer Subtraction to Determine Size CWE-469 0 (0.0%) Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') CWE-470 0 (0.0%) NULL Pointer Dereference CWE-476 0 (0.0%) Missing Default Case in Multiple Condition Expression CWE-478 0 (0.0%) Use of Incorrect Operator CWE-480 0 (0.0%) Incorrect Block Delimitation CWE-483 0 (0.0%) Omitted Break Statement in Switch CWE-484 0 (0.0%) Comparison of Classes by Name CWE-486 0 (0.0%) Private Data Structure Returned From A Public Method CWE-495 0 (0.0%) Public Data Assigned to Private Array-Typed Field CWE-496 0 (0.0%) Cloneable Class Containing Sensitive Information CWE-498 0 (0.0%) Serializable Class Containing Sensitive Data CWE-499 0 (0.0%) Weak Password Requirements CWE-521 0 (0.0%) Insufficiently Protected Credentials CWE-522 0 (0.0%) Suspicious Comment CWE-546 0 (0.0%) Use of Hard-coded, Security-relevant Constants CWE-547 0 (0.0%) Dead Code CWE-561 0 (0.0%) Assignment to Variable without Use CWE-563 0 (0.0%) Unsynchronized Access to Shared Data in a Multithreaded Context CWE-567 0 (0.0%) Assignment of a Fixed Address to a Pointer CWE-587 0 (0.0%) Comparison of Object References Instead of Object Contents CWE-595 0 (0.0%) Client-Side Enforcement of Server-Side Security CWE-602 0 (0.0%) Multiple Binds to the Same Port CWE-605 0 (0.0%) Reachable Assertion CWE-617 0 (0.0%) Variable Extraction Error CWE-621 0 (0.0%) Dynamic Variable Evaluation CWE-627 0 (0.0%) Function Call with Incorrectly Specified Arguments CWE-628 0 (0.0%) External Control of Critical State Data CWE-642 0 (0.0%) Incorrect Use of Privileged APIs CWE-648 0 (0.0%) Improper Locking CWE-667 0 (0.0%) Use of Potentially Dangerous Function CWE-676 0 (0.0%) Incorrect Conversion between Numeric Types CWE-681 0 (0.0%) Execution After Redirect (EAR) CWE-698 0 (0.0%) Incorrect Ownership Assignment CWE-708 0 (0.0%) Incorrect Permission Assignment for Critical Resource CWE-732 0 (0.0%) Missing Custom Error Page CWE-756 0 (0.0%) Release of Invalid Pointer or Reference CWE-763 0 (0.0%) Missing Release of Resource after Effective Lifetime CWE-772 0 (0.0%) Operator Precedence Logic Error CWE-783 0 (0.0%) Access of Memory Location Before Start of Buffer CWE-786 0 (0.0%) Access of Memory Location After End of Buffer CWE-788 0 (0.0%) Use of Hard-coded Credentials CWE-798 0 (0.0%) Buffer Access with Incorrect Length Value CWE-805 0 (0.0%) Untrusted Pointer Dereference CWE-822 0 (0.0%) Expired Pointer Dereference CWE-825 0 (0.0%) Inclusion of Functionality from Untrusted Control Sphere CWE-829 0 (0.0%) Inappropriate Encoding for Output Context CWE-838 0 (0.0%) Numeric Range Comparison Without Minimum Check CWE-839 0 (0.0%)

CVEs

Every CVE in this view

Summary Publication CVE ID Published
Boruta accepts expired JWT client assertions due to missing exp claim validation
pkg:hex/boruta
pkg:github/malach-it/boruta_auth
CVE-2026-53431 2026-07-30
Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion
pkg:hex/cowboy
pkg:github/ninenines/cowboy
CVE-2026-65624 2026-07-28
Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS
pkg:hex/cowlib
pkg:github/ninenines/cowlib
CVE-2026-59248 2026-07-28
BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding
pkg:otp/erts
pkg:github/erlang/otp
CVE-2026-54890 2026-07-27
Denial of service via exponential certificate policy tree growth in path validation
pkg:otp/public_key
pkg:github/erlang/otp
CVE-2026-59251 2026-07-27
Megaco flex scanner buffer overflow via oversized property parm name
pkg:otp/megaco
pkg:github/erlang/otp
CVE-2026-59250 2026-07-27
Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
pkg:otp/stdlib
pkg:github/erlang/otp
CVE-2026-47078 2026-07-27
epmd permanent DoS via EMFILE on accept(2) in erts
pkg:otp/erts
pkg:github/erlang/otp
CVE-2026-42792 2026-07-27
TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
pkg:otp/ssl
pkg:github/erlang/otp
CVE-2026-58227 2026-07-27
Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit
pkg:hex/bandit
pkg:github/mtrudel/bandit
CVE-2026-65623 2026-07-24
Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections
pkg:hex/mint
pkg:github/elixir-mint/mint
CVE-2026-59249 2026-07-16
Missing ID token claim validation in ueberauth_apple allows account takeover
pkg:hex/ueberauth_apple
pkg:github/ueberauth/ueberauth_apple
CVE-2026-55954 2026-07-14
Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory
pkg:hex/mint
pkg:github/elixir-mint/mint
CVE-2026-59246 2026-07-14
Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS
pkg:hex/mint
pkg:github/elixir-mint/mint
CVE-2026-58229 2026-07-14
Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
pkg:hex/phoenix_live_view
pkg:github/phoenixframework/phoenix_live_view
CVE-2026-58228 2026-07-13
Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)
pkg:hex/plug
pkg:github/elixir-plug/plug
CVE-2026-56814 2026-07-10
SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service
pkg:hex/postgrex
pkg:github/elixir-ecto/postgrex
CVE-2026-58225 2026-07-10
Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service
pkg:hex/phoenix
pkg:github/phoenixframework/phoenix
CVE-2026-56811 2026-07-07
mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5
pkg:hex/mint
pkg:github/elixir-mint/mint
CVE-2026-56810 2026-07-06
Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax
pkg:hex/hpax
pkg:github/elixir-mint/hpax
CVE-2026-58226 2026-07-06
DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions
pkg:otp/ssl
pkg:github/erlang/otp
CVE-2026-55950 2026-07-02
SSH SFTP server denial of service via extended channel data infinite loop
pkg:otp/ssh
pkg:github/erlang/otp
CVE-2026-54886 2026-07-02
Atom-table exhaustion denial-of-service via JSON parse_document in MDEx
pkg:hex/mdex
pkg:github/leandrocp/mdex
CVE-2026-53426 2026-06-29
Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)
pkg:hex/mdex
pkg:github/leandrocp/mdex
CVE-2026-54889 2026-06-29
Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex
pkg:hex/mdex
pkg:github/leandrocp/mdex
pkg:hex/mdex_native
pkg:github/leandrocp/mdex_native
CVE-2026-54888 2026-06-29
25 per page · 101 CVEs
Page of 5