vulnwire

All · hex

Newest first. Every filter here is also a feed: see the subscribe box.

  1. 8.2high
    CVE-2026-71397Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server
    hex
    15 h ago
  2. 8.2high
    CVE-2026-115701Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion
    hex
    25 h ago
  3. 8.7high
    CVE-2026-113431Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion
    hex
    25 h ago
  4. 2.1low
    CVE-2026-66294XML injection in Saxy via unescaped CDATA section terminator
    hex
    26 h ago
  5. 2.1low
    CVE-2026-66295Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection
    hex
    26 h ago
  6. 2.1low
    CVE-2026-66293XML comment injection in Saxy encoder via unescaped double hyphen
    hex
    26 h ago
  7. 6.2med
    CVE-2026-119434Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer
    hex
    40 h ago
  8. 8.9high
    CVE-2026-118391Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto
    hex
    2 d ago
  9. 6.3med
    CVE-2026-110826AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change
    hex
    3 d ago
  10. 6.3med
    CVE-2026-118505AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource
    hex
    3 d ago
  11. 7.6high
    CVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
    hex
    3 d ago
  12. 2.1low
    CVE-2026-117680jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not
    hex
    5 d ago
  13. 9.3crit
    CVE-2026-117656Unverified Sign in with Apple callback parameter can override verified ID token claims
    hex
    7 d ago
  14. 5.3med
    CVE-2026-117645Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
    hex
    7 d ago
  15. 9.1crit
    CVE-2026-117666ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
    hex
    7 d ago
  16. 8.7high
    CVE-2026-116078HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit
    hex
    9 d ago
  17. 2.3low
    CVE-2026-109823Host filesystem path disclosure via DNS rebinding
    hex
    10 d ago
  18. 5.9med
    CVE-2026-65630Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose
    hex
    11 d ago
  19. 5.1med
    CVE-2026-65632ECDSA signature length is not validated in jose, allowing signature malleability
    hex
    11 d ago
  20. 6.9med
    CVE-2026-65631erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service
    hex
    11 d ago
  21. 7.4high
    CVE-2026-65629Weak PBKDF2 parameters for password-encrypted private-key export in jose
    hex
    11 d ago
  22. 5.9med
    CVE-2026-65628Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types
    hex
    11 d ago
  23. 6.9med
    CVE-2026-65627Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2
    hex
    11 d ago
  24. 5.9med
    CVE-2026-65626Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose
    hex
    11 d ago
  25. 5.9med
    CVE-2026-65625Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose
    hex
    11 d ago
  26. 8.2high
    CVE-2026-97200Unbounded response body buffering and decompression in hackney
    hex
    11 d ago
  27. 9.1crit
    CVE-2026-115693Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
    hex
    11 d ago
  28. 6.0med
    CVE-2026-113440HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
    hex
    11 d ago
  29. 6.9med
    CVE-2026-115700SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
    hex
    11 d ago
  30. 2.1low
    CVE-2026-112880CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
    hex
    11 d ago