H
Vendor security profile
hex
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs19
Critical2
CISA KEV0
Public exploit5
Patch rate%89
Avg. CVSS7.1
12-month vulnerability rate
0
0
1
0
1
0
1
10
2
3
1
0
CVE KEV
CVE severity distribution
19toplam CVE
Critical2 (11%)
High9 (47%)
Medium7 (37%)
Low1 (5%)
Patch and exploitation view
%89
Verified patch
%0
CISA KEV
%26
Public exploit
17Patch available
0Partial
0Workaround
0Vendor: no patch
2Unknown
Latest vulnerabilities
5.9
CVE-2026-103502
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
H
Patch verified
-
CVE-2026-54892
Plug: quadratic-time decoding of nested query/body parameters enables denial of service
H
Patch status unknownEPSS %1
2.3
CVE-2026-86698
Refresh tokens accepted as private repository credentials at the CDN
H
Patch verifiedEPSS %0
-
CVE-2026-49757
AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching
H
Patch verifiedEPSS %1
-
CVE-2026-53430
gRPC Erlang package has unbounded gzip decompression (decompression bomb)
H
Patch verifiedEPSS %1
2.3
CVE-2026-75554
Explicit organization scopes survive token refresh after membership ends
H
Patch verifiedEPSS %0
8.3
CVE-2026-75542
OAuth token exchange grants repository scopes for organizations the principal cannot access
H
Patch verifiedEPSS %0
7.5
CVE-2026-73394
WordPress Stitch Express plugin <= 1.9.0 - Broken Access Control vulnerability
S
Patch status unknownEPSS %0
-
CVE-2026-53423
membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion
H
Patch verifiedEPSS %0
6.3
CVE-2026-56812
Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff
P
Patch verifiedEPSS %1