hexpm hex.pm vulnerabilities

3 published CVEs name hexpm hex.pm among the affected products.

All 3 in the list Atom feed of new CVEs

Published CVEs: 3
Last 12 months: 3
Critical: 1
Known exploited: 0

Critical 1High 2Medium 0Low 0Not scored 0

Newest CVEs

CVE-2026-21622
Password Reset Tokens Do Not Expire
hexpm · hexpm
Critical9.5
CVE-2026-21621
Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access
hexpm · hexpm
High7.0
CVE-2026-21618
Cross-site scripting (XSS) in OAuth Device Authorization screen
hexpm · hexpm
High8.5

Most common weaknesses