These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-105274 is a Data Amplification vulnerability in hex_core that allows an attacker to exhaust the memory of the Erlang VM. The vulnerability affects hex_core, hex, and rebar3. Defenders should assess exposure and prioritize remediation based on the severity of the vulnerability and the potential impact on their systems. The affected code is vendored in hex and rebar3, and the fix for CVE-2026-21619 [truncated]
A vulnerability in Hex allows a malicious package publisher or hostile repository server to inject terminal control sequences into the output of Mix tasks. This can lead to forged displayed URLs, package descriptions, and suggested commands, or writing to the clipboard. The vulnerability affects package metadata and configuration snippets, search results, owner and organization listings, publish and spons [truncated]
CVE-2026-96612 debrief based on the supplied source corpus. The CVE record was published on 2026-10-12T15:39:49.862Z and has not been modified since then. The vulnerability is a path traversal issue in hex that allows a malicious package publisher to delete directories outside the project's deps directory and extract package files into it. This occurs when a developer fetches dependencies using unvalidate [truncated]
A Protection Mechanism Failure vulnerability in hexpm hex allows an attacker to bypass the release-age cooldown, potentially leading to the selection of a malicious release during dependency resolution. The vulnerability occurs when the release of a package locked in mix.lock is retired or has a security advisory, causing Hex.RemoteConverger.build_cooldown_bypass/3 and Hex.RemoteConverger.unsafe_lock_bypa [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-12T15:30:14.126Z and has not been modified since then. The vulnerability allows a package mirror to substitute the tarball written to standard output by mix hex.package fetch due to improper validation of integrity check values in hexpm hex. This may impact environments where package mirrors are con [truncated]
CVE-2026-96618 is a vulnerability in the hex package for Elixir that allows an untrusted package mirror to exhaust the memory or disk space of a machine running certain mix commands. The vulnerability is due to improper handling of highly compressed data, which can cause a denial of service. The vulnerability has a CVSS score of 2.1 and is considered low severity.
A vulnerability in hexpm's hex package allows an attacker to impersonate a host to users who set cacerts_path to a CA store that leaves a specific CA out. This issue affects hex versions from 0.20.2 before 2.5.2. The vulnerability arises from improper certificate validation when cacerts_path is set, causing the package to trust its bundled CA certificates. As a result, an attacker can intercept HTTPS conn [truncated]
CVE-2026-103502 debrief: The hex_core library's default HTTP adapter fails to verify TLS certificates on Erlang/OTP 24 and 25, allowing for man-in-the-middle attacks. This vulnerability affects users who utilize hex_core for HTTPS connections. Developers and administrators should assess their exposure and verify certificate validation to mitigate potential risks. The issue arises from improper certificate [truncated]
The CVE-2026-75554 vulnerability in hexpm's OAuth token refresh grant allows a user removed from an organization to keep reading its private packages due to insufficient session expiration. This issue arises because the refresh grant re-derives a new token from stored granted scopes, reproducing the organization scope without revisiting membership. The affected product is hex.pm, which is used for managin [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-24T21:17:47.373Z and has not been modified since then. CVE-2026-75542 is an Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm. An API key holding the repositories permission can read another organization's private packages. The vulnerability arises because validate_sco [truncated]
CVE-2026-23940 is an Uncontrolled Resource Consumption vulnerability in hexpm/hexpm. Publishing an oversized package can cause Hex.pm to run out of memory, resulting in a denial of service for package publishing and potentially other package-processing functionality. This issue affects hex.pm before 2026-03-10. The vulnerability can cause significant disruption to package publishing and processing, emphas [truncated]