How many CVEs does hexpm have?

hexpm has 21 published CVE records since 2019, including 19 in the last two years.

How many hexpm CVEs are in CISA KEV?

None of hexpm's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which hexpm products have the most CVEs?

The hexpm products with the most published CVEs are hex, hexpm, hex_core, hex.pm.

What are the most common weakness types in hexpm CVEs?

hexpm's CVEs most often map to these CWE weakness types: CWE-613 (Insufficient Session Expiration), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-295 (Improper Certificate Validation), CWE-345 (Insufficient Verification of Data Authenticity).

Are there public exploits for hexpm vulnerabilities?

Yes — 4 of hexpm's CVEs have a known public exploit.

How many critical hexpm vulnerabilities are there?

hexpm has 1 critical and 9 high-severity CVEs.

What is the average severity of hexpm CVEs?

The average CVSS base score across hexpm's scored CVEs is 6.0.

RadicalNotion.AI

Log in Create an account

21 CVEs

hexpm Vulnerabilities

Name: hexpm vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for hexpm.

21

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

4

Public exploits

PoC or exploit code

6.0

Avg CVSS

2019–2026

Overview

hexpm has 21 published CVE records since 2019, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 4 have a known public exploit. The average CVSS base score across scored CVEs is 6.0.

Security scorecard

A quick read on hexpm's vulnerability posture, as a share of its 21 published CVEs.

Average CVSS: 6.0
Critical / high: 48%
Actively exploited (KEV): 0%
Public exploit available: 19%
Patch available: 100%

Severity and exploitation

How the CVSS severity of hexpm's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High9

Medium5

Low6

In CISA’s Known Exploited Vulnerabilities catalog

0

None of hexpm's CVEs are currently listed in CISA's KEV catalog.

Public exploits

4

4 of hexpm's CVEs have a known public exploit available.

Most affected products

The hexpm products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in hexpm CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish hexpm CVE records.

Disclosure activity by year

How many hexpm CVEs were published each year.

2019

2

2026

19

Latest hexpm CVEs

The most recently disclosed vulnerabilities affecting hexpm.

erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
CWE-835
Medium · CVSS 5.9
EPSS 0.2%2026-10-14
hex_core decompresses registry and Erlang term API responses without size limits
CWE-409
Low · CVSS 2.1
EPSS 0.4%2026-10-12
Terminal escape sequence injection in Hex via unneutralized server-supplied output
CWE-150
Low · CVSS 2.3
EPSS 0.4%2026-10-12
Path traversal in Hex via unvalidated dependency app names
CWE-22
High · CVSS 7.5
EPSS 0.4%2026-10-12
Hex release-age cooldown is lifted package-wide when the locked release is retired
CWE-693
High · CVSS 7.1
EPSS 0.3%2026-10-12
Hex writes unverified package tarballs to standard output in mix hex.package fetch
CWE-354
Medium · CVSS 6.9
EPSS 0.2%2026-10-12
Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror
CWE-409
Low · CVSS 2.1
EPSS 0.3%2026-10-12
Hex trusts its bundled CA certificates when cacerts_path is set
CWE-295
Medium · CVSS 5.9
EPSS 0.2%2026-10-12
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
CWE-295
Medium · CVSS 5.9
EPSS 0.2%2026-10-12
Refresh tokens accepted as private repository credentials at the CDN
CWE-613
Low · CVSS 2.3
EPSS 0.4%2026-09-22
Explicit organization scopes survive token refresh after membership ends
CWE-613
Low · CVSS 2.3
EPSS 0.4%2026-08-24
OAuth token exchange grants repository scopes for organizations the principal cannot access
CWE-863
High · CVSS 8.3
EPSS 0.5%2026-08-24

Get an alert for each new hexpm CVE, with AI-written analysis and remediation steps.

Monitor hexpm CVEs

Other vendors

CVE counts for other vendors.

microsoft41,739 CVEs linux25,260 CVEs Google17,495 CVEs Apple15,495 CVEs Oracle13,348 CVEs Debian10,233 CVEs IBM9,452 CVEs Red Hat8,581 CVEs

Browse all vendors

Frequently asked questions

Common questions about hexpm vulnerabilities.

How many CVEs does hexpm have?: hexpm has 21 published CVE records since 2019, including 19 in the last two years.
How many hexpm CVEs are in CISA KEV?: None of hexpm's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which hexpm products have the most CVEs?: The hexpm products with the most published CVEs are hex, hexpm, hex_core, hex.pm.
What are the most common weakness types in hexpm CVEs?: hexpm's CVEs most often map to these CWE weakness types: CWE-613 (Insufficient Session Expiration), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-295 (Improper Certificate Validation), CWE-345 (Insufficient Verification of Data Authenticity).
Are there public exploits for hexpm vulnerabilities?: Yes — 4 of hexpm's CVEs have a known public exploit.
How many critical hexpm vulnerabilities are there?: hexpm has 1 critical and 9 high-severity CVEs.
What is the average severity of hexpm CVEs?: The average CVSS base score across hexpm's scored CVEs is 6.0.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track hexpm vulnerabilities

Get an alert for each new hexpm CVE, with AI-written analysis and remediation steps.

Create an account See pricing