What’s Vulnerable › Products

hexpm vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your hexpm version is affected

Latest hexpm vulnerabilities

• CVE-2026-86698 — Refresh tokens accepted as private repository credentials at the CDN (CVSS 2.3)
• CVE-2026-75554 — Explicit organization scopes survive token refresh after membership ends (CVSS 2.3)
• CVE-2026-75542 — OAuth token exchange grants repository scopes for organizations the principal cannot access (CVSS 8.3)
• CVE-2026-23940 — Denial of Service via Oversized Package Upload (CVSS 6.5)
• CVE-2026-21622 — Password Reset Tokens Do Not Expire (CVSS 9.8)
• CVE-2026-21621 — Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access (CVSS 5.3)
• CVE-2026-23939 — Path Traversal in Local File Store Backend (CVSS 7.5)
• CVE-2026-21618 — Cross-site scripting (XSS) in OAuth Device Authorization screen (CVSS 6.1)