H
Vendor security profile
hexpm
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs14
Critical0
CISA KEV0
Public exploit3
Patch rate%100
Avg. CVSS5.2
12-month vulnerability rate
0
0
1
1
1
0
0
0
0
2
1
8
CVE KEV
CVE severity distribution
14toplam CVE
High3 (21%)
Medium6 (43%)
Low5 (36%)
Patch and exploitation view
%100
Verified patch
%0
CISA KEV
%21
Public exploit
14Patch available
0Partial
0Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
2.1
CVE-2026-105274
hex_core decompresses registry and Erlang term API responses without size limits
E
Patch verified
2.3
CVE-2026-81856
Terminal escape sequence injection in Hex via unneutralized server-supplied output
H
Patch verified
7.5
CVE-2026-96612
Path traversal in Hex via unvalidated dependency app names
H
Patch verified
7.1
CVE-2026-105668
Hex release-age cooldown is lifted package-wide when the locked release is retired
H
Patch verified
6.9
CVE-2026-105280
Hex writes unverified package tarballs to standard output in mix hex.package fetch
H
Patch verified
2.1
CVE-2026-96618
Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror
H
Patch verified
5.9
CVE-2026-103503
Hex trusts its bundled CA certificates when cacerts_path is set
H
Patch verified
5.9
CVE-2026-103502
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
H
Patch verified
2.3
CVE-2026-86698
Refresh tokens accepted as private repository credentials at the CDN
H
Patch verifiedEPSS %0
2.3
CVE-2026-75554
Explicit organization scopes survive token refresh after membership ends
H
Patch verifiedEPSS %0