# Hex Advisories.

Every Hex Advisory we hold (Elixir · Erlang), newest first.

## Records, newest first (an older page)

- [CDATA Section Breakout via Unsanitised \]\]> in xml_builder](https://agentprime.io/advisories/GHSA-67r9-hmxw-h595.md)
  `GHSA-67r9-hmxw-h595`, `CVE-2026-47080`, `EEF-CVE-2026-47080` · Hex `xml_builder`: affected `>=0.0.7, <2.4.1`, fixed in `2.4.1` · CVSS 2.1 Low · Not analysed yet · Published 21 Aug 2026 · Tags: Other injection
- [HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit](https://agentprime.io/advisories/GHSA-x3gh-xhj4-3vq8.md)
  `GHSA-x3gh-xhj4-3vq8`, `CVE-2026-75484`, `EEF-CVE-2026-75484` · Hex `bandit`: affected `>=1.4.0, <1.12.5`, fixed in `1.12.5` · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection
- [HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit](https://agentprime.io/advisories/GHSA-xj8g-532w-jv94.md)
  `GHSA-xj8g-532w-jv94`, `CVE-2026-74836`, `EEF-CVE-2026-74836` · Hex `bandit`: affected `>=0.3.4, <1.12.5`, fixed in `1.12.5` · CVSS 8.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service
- [Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions](https://agentprime.io/advisories/EEF-CVE-2026-53424.md)
  `EEF-CVE-2026-53424`, `CVE-2026-53424` · Hex `samly`: affected `>=0.3.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Authentication bypass
- [Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses](https://agentprime.io/advisories/EEF-CVE-2026-53425.md)
  `EEF-CVE-2026-53425`, `CVE-2026-53425` · Hex `samly`: affected `>=0.3.0`, no fixed version yet · CVSS 7.6 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-345
- [On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay](https://agentprime.io/advisories/GHSA-vp5h-xh25-44wf.md)
  `GHSA-vp5h-xh25-44wf`, `CVE-2026-67581`, `EEF-CVE-2026-67581` · Hex `mpp`: affected `>=0.3.0, <0.6.3`, fixed in `0.6.3` · CVSS 8.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: Authentication bypass
- [Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain](https://agentprime.io/advisories/GHSA-j4j7-7xpr-c7cr.md)
  `GHSA-j4j7-7xpr-c7cr`, `CVE-2026-73541`, `EEF-CVE-2026-73541` · Hex `mpp`: affected `>=0.2.0, <0.12.0`, fixed in `0.12.0` · CVSS 8.3 High · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service
- [Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay](https://agentprime.io/advisories/GHSA-34g7-vx6g-82mq.md)
  `GHSA-34g7-vx6g-82mq`, `CVE-2026-73136`, `EEF-CVE-2026-73136` · Hex `mpp`: affected `>=0.6.1, <0.6.4`, fixed in `0.6.4` · CVSS 8.2 High · Not analysed yet · Published 19 Aug 2026 · Tags: Authentication bypass
- [Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race](https://agentprime.io/advisories/GHSA-w8j7-7qc3-5f24.md)
  `GHSA-w8j7-7qc3-5f24`, `CVE-2026-73829`, `EEF-CVE-2026-73829` · Hex `mpp`: affected `>=0.2.0, <0.6.1`, fixed in `0.6.1` · CVSS 6.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Race condition
- [membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion](https://agentprime.io/advisories/GHSA-43hj-fxwj-49qw.md)
  `GHSA-43hj-fxwj-49qw`, `CVE-2026-53423`, `EEF-CVE-2026-53423` · Hex `membrane_mp4_plugin`: affected `<0.36.7`, fixed in `0.36.7` · CVSS 5.9 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service
- [Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1](https://agentprime.io/advisories/EEF-CVE-2026-43971.md)
  `EEF-CVE-2026-43971`, `CVE-2026-43971` · Hex `cowlib`: affected `>=2.9.0, <2.20.0`, fixed in `2.20.0` · CVSS 6.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-116
- [Filter expression injection via forged keyset pagination cursor in Ash](https://agentprime.io/advisories/GHSA-3gq3-9xm3-c8v3.md)
  `GHSA-3gq3-9xm3-c8v3`, `CVE-2026-67579`, `EEF-CVE-2026-67579` · Hex `ash`: affected `>=1.17.0, <3.31.3`, fixed in `3.31.3` · CVSS 7.5 High · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection, Insecure deserialization
- [Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR](https://agentprime.io/advisories/GHSA-36m4-rm57-3prf.md)
  `GHSA-36m4-rm57-3prf`, `CVE-2026-64941`, `EEF-CVE-2026-64941` · Hex `phoenix_live_view`: affected `>=0.5.0, <1.0.19 || >=1.1.0-rc.0, <1.1.33 || >=1.2.0-rc.0, <1.2.9`, fixed in `1.0.19`, `1.1.33`, `1.2.9` · CVSS 2.1 Low · Not analysed yet · Published 10 Aug 2026 · Tags: Open redirect
- [Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash](https://agentprime.io/advisories/GHSA-vvp6-3wv6-833j.md)
  `GHSA-vvp6-3wv6-833j`, `CVE-2026-70395`, `EEF-CVE-2026-70395` · Hex `ash`: affected `>=1.52.0-rc.11, <3.31.1`, fixed in `3.31.1` · CVSS 2.1 Low · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection
- [Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset](https://agentprime.io/advisories/GHSA-j35q-v8h8-7mwq.md)
  `GHSA-j35q-v8h8-7mwq`, `CVE-2026-69659`, `EEF-CVE-2026-69659` · Hex `ash`: affected `>=1.17.0, <3.31.1`, fixed in `3.31.1` · CVSS 5.9 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Insecure deserialization
- [Atom Exhaustion via \_entities Representation Keys in DivvyPayHQ absinthe_federation](https://agentprime.io/advisories/GHSA-55hv-mwvr-phf3.md)
  `GHSA-55hv-mwvr-phf3`, `CVE-2026-67585`, `EEF-CVE-2026-67585` · Hex `absinthe_federation`: affected `>=0.1.0, <0.9.3`, fixed in `0.9.3` · CVSS 8.7 High · Not analysed yet · Published 7 Aug 2026 · Tags: Denial of service
- [SQL injection via the :comment option in Postgrex.stream/4](https://agentprime.io/advisories/GHSA-3gww-3f36-2388.md)
  `GHSA-3gww-3f36-2388`, `CVE-2026-66838`, `EEF-CVE-2026-66838` · Hex `postgrex`: affected `>=0.19.3, <0.22.4`, fixed in `0.22.4` · CVSS 5.9 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: SQL injection
- [Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service](https://agentprime.io/advisories/GHSA-463q-p2fr-mh9p.md)
  `GHSA-463q-p2fr-mh9p`, `CVE-2026-68750`, `EEF-CVE-2026-68750` · Hex `html_sanitize_ex`: affected `>=0.3.1, <1.4.5 || >=1.5.0-rc.0, <1.5.3`, fixed in `1.4.5`, `1.5.3` · CVSS 8.2 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service
- [Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service](https://agentprime.io/advisories/GHSA-4cx2-987x-rr2x.md)
  `GHSA-4cx2-987x-rr2x`, `CVE-2026-68749`, `EEF-CVE-2026-68749` · Hex `html_sanitize_ex`: affected `>=0.3.1, <1.4.5 || >=1.5.0-rc.0, <1.5.3`, fixed in `1.4.5`, `1.5.3` · CVSS 8.2 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service
- [CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input](https://agentprime.io/advisories/GHSA-87v2-pfhj-r5x7.md)
  `GHSA-87v2-pfhj-r5x7`, `CVE-2026-68747`, `EEF-CVE-2026-68747` · Hex `html_sanitize_ex`: affected `>=0.3.1, <1.4.5 || >=1.5.0-rc.0, <1.5.4`, fixed in `1.4.5`, `1.5.4` · CVSS 2.3 Low · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection
- [html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection](https://agentprime.io/advisories/GHSA-2c6f-3j54-xpcr.md)
  `GHSA-2c6f-3j54-xpcr`, `CVE-2026-66829`, `EEF-CVE-2026-66829` · Hex `html_sanitize_ex`: affected `>=0.3.1, <1.4.5 || >=1.5.0-rc.0, <1.5.3`, fixed in `1.4.5`, `1.5.3` · CVSS 2.3 Low · Not analysed yet · Published 6 Aug 2026 · Tags: Open redirect
- [html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking](https://agentprime.io/advisories/GHSA-w3f9-jjhw-wwvq.md)
  `GHSA-w3f9-jjhw-wwvq`, `CVE-2026-66370`, `EEF-CVE-2026-66370` · Hex `html_sanitize_ex`: affected `>=0.3.1, <1.4.5 || >=1.5.0-rc.0, <1.5.3`, fixed in `1.4.5`, `1.5.3` · CVSS 4.8 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Open redirect
- [html_sanitize_ex HTML5 scrubber keeps attacker-supplied \`\<object>\` elements, allowing untrusted content embedding](https://agentprime.io/advisories/GHSA-xmm9-jc22-rcgj.md)
  `GHSA-xmm9-jc22-rcgj`, `CVE-2026-66843`, `EEF-CVE-2026-66843` · Hex `html_sanitize_ex`: affected `>=0.3.1, <1.4.5 || >=1.5.0-rc.0, <1.5.3`, fixed in `1.4.5`, `1.5.3` · CVSS 2.3 Low · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-829
- [Livebook Teams identity callback lacks state binding, allowing login CSRF](https://agentprime.io/advisories/GHSA-pvvw-28fw-c6fg.md)
  `GHSA-pvvw-28fw-c6fg`, `CVE-2026-66885`, `EEF-CVE-2026-66885` · Hex `livebook`: affected `>=0.15.0, <0.18.7 || >=0.19.0, <0.19.9`, fixed in `0.18.7`, `0.19.9` · CVSS 6.8 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts](https://agentprime.io/advisories/GHSA-68c2-prqg-x62g.md)
  `GHSA-68c2-prqg-x62g`, `CVE-2026-66298`, `EEF-CVE-2026-66298` · Hex `livebook`: affected `>=0.5.0, <0.18.7 || >=0.19.0, <0.19.9`, fixed in `0.18.7`, `0.19.9` · CVSS 8.6 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-346
- [Unescaped deployment environment variables in generated setup commands](https://agentprime.io/advisories/GHSA-qpjc-w5mm-73mj.md)
  `GHSA-qpjc-w5mm-73mj`, `CVE-2026-66297`, `EEF-CVE-2026-66297` · Hex `livebook`: affected `>=0.13.0, <0.18.7 || >=0.19.0, <0.19.9`, fixed in `0.18.7`, `0.19.9` · CVSS 5.0 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Command injection
- [Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download](https://agentprime.io/advisories/GHSA-r4h8-2xpq-v48g.md)
  `GHSA-r4h8-2xpq-v48g`, `CVE-2026-66881`, `EEF-CVE-2026-66881` · Hex `livebook`: affected `>=0.11.0, <0.18.7 || >=0.19.0, <0.19.9`, fixed in `0.18.7`, `0.19.9` · CVSS 7.0 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access](https://agentprime.io/advisories/GHSA-74j5-6grg-g6wj.md)
  `GHSA-74j5-6grg-g6wj`, `CVE-2026-68746`, `EEF-CVE-2026-68746` · Hex `livebook`: affected `>=0.19.7, <0.19.9`, fixed in `0.19.9` · CVSS 7.7 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-636
- [Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup](https://agentprime.io/advisories/GHSA-w5r8-m75h-98fc.md)
  `GHSA-w5r8-m75h-98fc`, `CVE-2026-66883`, `EEF-CVE-2026-66883` · Hex `oidcc_plug`: affected `>=0.1.0-alpha.3, <0.5.0`, fixed in `0.5.0` · CVSS 6.3 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: CWE-178
- [Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection](https://agentprime.io/advisories/GHSA-fg66-w5gp-22cr.md)
  `GHSA-fg66-w5gp-22cr`, `CVE-2026-66884`, `EEF-CVE-2026-66884` · Hex `oidcc_plug`: affected `>=0.2.0-beta.1, <0.5.0`, fixed in `0.5.0` · CVSS 2.1 Low · Not analysed yet · Published 4 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Reflected XSS in oaskit's default HTML error handler](https://agentprime.io/advisories/GHSA-h7xw-x8wr-xpcc.md)
  `GHSA-h7xw-x8wr-xpcc`, `CVE-2026-66296`, `EEF-CVE-2026-66296` · Hex `oaskit`: affected `>=0.1.0, <0.14.1`, fixed in `0.14.1` · CVSS 5.1 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Cross-site scripting (XSS)
- [guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1](https://agentprime.io/advisories/GHSA-9qx2-v587-q3gg.md)
  `GHSA-9qx2-v587-q3gg`, `CVE-2026-55734`, `EEF-CVE-2026-55734` · Hex `guardian`: affected `>=2.0.0, <2.4.1`, fixed in `2.4.1` · CVSS 6.9 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service
- [Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation](https://agentprime.io/advisories/GHSA-fjr5-7xrc-hmpj.md)
  `GHSA-fjr5-7xrc-hmpj`, `CVE-2026-55733`, `EEF-CVE-2026-55733` · Hex `guardian`: affected `>=2.0.0, <2.4.1`, fixed in `2.4.1` · CVSS 6.9 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service
- [Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys](https://agentprime.io/advisories/GHSA-xqch-c77q-rgh5.md)
  `GHSA-xqch-c77q-rgh5`, `CVE-2026-54894`, `EEF-CVE-2026-54894` · Hex `guardian`: affected `>=0.1.0, <2.4.1`, fixed in `2.4.1` · CVSS 6.9 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Denial of service
- [Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation](https://agentprime.io/advisories/GHSA-7975-hp3r-5qhv.md)
  `GHSA-7975-hp3r-5qhv`, `CVE-2026-55735`, `EEF-CVE-2026-55735` · Hex `guardian`: affected `>=1.0.0, <2.4.1`, fixed in `2.4.1` · CVSS 8.2 High · Not analysed yet · Published 1 Aug 2026 · Tags: Weak cryptography or TLS
- [YAML injection via unescaped newlines in ymlr document comments](https://agentprime.io/advisories/GHSA-p8qx-7cp9-v6c9.md)
  `GHSA-p8qx-7cp9-v6c9`, `CVE-2026-65636`, `EEF-CVE-2026-65636` · Hex `ymlr`: affected `>=0.0.1, <5.1.6`, fixed in `5.1.6` · CVSS 2.1 Low · Not analysed yet · Published 31 Jul 2026 · Tags: Other injection
- [Boruta accepts expired JWT client assertions due to missing exp claim validation](https://agentprime.io/advisories/GHSA-xjv8-vmh5-xhf6.md)
  `GHSA-xjv8-vmh5-xhf6`, `CVE-2026-53431`, `EEF-CVE-2026-53431` · Hex `boruta`: affected `>=2.3.0, <2.3.7`, fixed in `2.3.7` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: Authentication bypass
- [Boruta dynamic client registration allows creation of over-privileged OAuth clients](https://agentprime.io/advisories/GHSA-w869-fcf2-68vp.md)
  `GHSA-w869-fcf2-68vp`, `CVE-2026-65635`, `EEF-CVE-2026-65635` · Hex `boruta`: affected `>=2.3.0, <2.3.7`, fixed in `2.3.7` · CVSS 8.3 High · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-653
- [Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching](https://agentprime.io/advisories/GHSA-5q9h-vf5j-fr2g.md)
  `GHSA-5q9h-vf5j-fr2g`, `CVE-2026-54885`, `EEF-CVE-2026-54885` · Hex `boruta`: affected `>=2.3.2, <2.3.7`, fixed in `2.3.7` · CVSS 6.9 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Server-side request forgery (SSRF)
- [Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion](https://agentprime.io/advisories/EEF-CVE-2026-65624.md)
  `EEF-CVE-2026-65624`, `CVE-2026-65624` · Hex `cowboy`: affected `>=2.0.0-pre.4, <2.18.0`, fixed in `2.18.0` · CVSS 6.9 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service
- [Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS](https://agentprime.io/advisories/EEF-CVE-2026-59248.md)
  `EEF-CVE-2026-59248`, `CVE-2026-59248` · Hex `cowlib`: affected `>=2.0.0-pre.1, <2.19.0`, fixed in `2.19.0` · CVSS 8.7 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service
- [Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit](https://agentprime.io/advisories/GHSA-vg8x-66vg-5pxh.md)
  `GHSA-vg8x-66vg-5pxh`, `CVE-2026-65623`, `EEF-CVE-2026-65623` · Hex `bandit`: affected `>=1.11.0, <1.12.1`, fixed in `1.12.1` · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections](https://agentprime.io/advisories/GHSA-x3x7-96vm-6h2w.md)
  `GHSA-x3x7-96vm-6h2w`, `CVE-2026-59249`, `EEF-CVE-2026-59249` · Hex `mint`: affected `>=0.1.0, <1.9.3`, fixed in `1.9.3` · CVSS 6.3 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: HTTP request smuggling
- [Protobuf: Unbounded recursion depth in embedded-message decoding](https://agentprime.io/advisories/GHSA-rv48-qqj5-crxg.md)
  `GHSA-rv48-qqj5-crxg`, `CVE-2026-54451` · Hex `protobuf`: affected `>=0.8.0, <0.16.1`, fixed in `0.16.1` · CVSS 8.2 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service
- [Missing ID token claim validation in ueberauth_apple allows account takeover](https://agentprime.io/advisories/GHSA-pxx8-68pc-p9mr.md)
  `GHSA-pxx8-68pc-p9mr`, `CVE-2026-55954`, `EEF-CVE-2026-55954` · Hex `ueberauth_apple`: affected `>=0.1.0, <0.6.2`, fixed in `0.6.2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2026 · Tags: Authentication bypass
- [Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory](https://agentprime.io/advisories/GHSA-8pf6-g464-h6h9.md)
  `GHSA-8pf6-g464-h6h9`, `CVE-2026-59246`, `EEF-CVE-2026-59246` · Hex `mint`: affected `>=0.1.0, <1.9.2`, fixed in `1.9.2` · CVSS 6.3 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS](https://agentprime.io/advisories/GHSA-qrfr-wh4c-3qhw.md)
  `GHSA-qrfr-wh4c-3qhw`, `CVE-2026-58229`, `EEF-CVE-2026-58229` · Hex `mint`: affected `>=0.1.0, <1.9.2`, fixed in `1.9.2` · CVSS 8.2 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service
- [Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>](https://agentprime.io/advisories/GHSA-5cgh-g58j-m9cq.md)
  `GHSA-5cgh-g58j-m9cq`, `CVE-2026-58228`, `EEF-CVE-2026-58228` · Hex `phoenix_live_view`: affected `>=1.2.2, <1.2.7`, fixed in `1.2.7` · CVSS 5.1 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Cookie attribute injection in Plug.Conn.Cookies.encode/2](https://agentprime.io/advisories/GHSA-wpmj-jh88-rpgm.md)
  `GHSA-wpmj-jh88-rpgm`, `CVE-2026-56813`, `EEF-CVE-2026-56813` · Hex `plug`: affected `>=0.1.0, <1.16.6 || >=1.17.0, <1.17.4 || >=1.18.0, <1.18.5 || >=1.19.1, <1.19.5 || >=1.20.0, <1.20.3`, fixed in `1.16.6`, `1.17.4`, `1.18.5`, `1.19.5`, `1.20.3` · CVSS 2.1 Low · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-141
- [Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)](https://agentprime.io/advisories/GHSA-95qv-c9g9-rm63.md)
  `GHSA-95qv-c9g9-rm63`, `CVE-2026-56814`, `EEF-CVE-2026-56814` · Hex `plug`: affected `>=1.4.0-rc.0, <1.16.6 || >=1.17.0, <1.17.4 || >=1.18.0, <1.18.5 || >=1.19.1, <1.19.5 || >=1.20.0, <1.20.3`, fixed in `1.16.6`, `1.17.4`, `1.18.5`, `1.19.5`, `1.20.3` · CVSS 6.9 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service
- [SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service](https://agentprime.io/advisories/GHSA-4mw9-4qgj-m97w.md)
  `GHSA-4mw9-4qgj-m97w`, `CVE-2026-58225`, `EEF-CVE-2026-58225` · Hex `postgrex`: affected `>=0.16.0, <0.22.3`, fixed in `0.22.3` · CVSS 2.1 Low · Not analysed yet · Published 10 Jul 2026 · Tags: SQL injection
- [Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff](https://agentprime.io/advisories/GHSA-63mc-hw7g-86rr.md)
  `GHSA-63mc-hw7g-86rr`, `CVE-2026-56812`, `EEF-CVE-2026-56812` · Hex `phoenix` and 1 more: affected `>=1.2.0-rc.0, <1.5.15 || >=1.6.0-rc.0, <1.6.17 || >=1.7.0-rc.0, <1.7.24 || >=1.8.0-rc.0, <1.8.9`, fixed in `1.5.15`, `1.6.17`, `1.7.24`, `1.8.9` · CVSS 6.3 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-754
- [Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service](https://agentprime.io/advisories/GHSA-6983-jfq8-485w.md)
  `GHSA-6983-jfq8-485w`, `CVE-2026-56811`, `EEF-CVE-2026-56811` · Hex `phoenix`: affected `>=0.11.0, <1.5.15 || >=1.6.0-rc.0, <1.6.17 || >=1.7.0-rc.0, <1.7.24 || >=1.8.0-rc.0, <1.8.9`, fixed in `1.5.15`, `1.6.17`, `1.7.24`, `1.8.9` · CVSS 8.7 High · Not analysed yet · Published 7 Jul 2026 · Tags: Denial of service
- [mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5](https://agentprime.io/advisories/GHSA-c59h-fq4p-r36r.md)
  `GHSA-c59h-fq4p-r36r`, `CVE-2026-56810`, `EEF-CVE-2026-56810` · Hex `mint`: affected `>=0.5.0, <1.9.1`, fixed in `1.9.1` · CVSS 8.7 High · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service
- [Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax](https://agentprime.io/advisories/GHSA-jj2p-32j7-whj2.md)
  `GHSA-jj2p-32j7-whj2`, `CVE-2026-58226`, `EEF-CVE-2026-58226` · Hex `hpax`: affected `>=0.1.1, <1.0.4`, fixed in `1.0.4` · CVSS 8.7 High · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service
- [QUIC has Broken TLS verification](https://agentprime.io/advisories/GHSA-2r8v-p65x-3663.md)
  `GHSA-2r8v-p65x-3663`, `CVE-2026-49457` · Hex `quic`: affected `<1.4.4`, fixed in `1.4.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Weak cryptography or TLS
- [RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API](https://agentprime.io/advisories/GHSA-w6cq-9cf4-gqpg.md)
  `GHSA-w6cq-9cf4-gqpg`, `BIT-rabbitmq-2023-46118`, `CVE-2023-46118` · Hex `rabbit_common`: affected `>=3.11.0, <3.11.24 || >=3.12.0, <3.12.7`, fixed in `3.11.24`, `3.12.7` · CVSS 4.9 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Denial of service
- [RabbitMQ has predictable credential obfuscation seed value used in Shovel and Federation plugins](https://agentprime.io/advisories/GHSA-v9gv-xp36-jgj8.md)
  `GHSA-v9gv-xp36-jgj8`, `BIT-rabbitmq-2022-31008`, `CVE-2022-31008` · Hex `rabbit_common`: affected `>=3.8.0, <3.8.32 || >=3.9.0, <3.9.18 || >=3.10.0, <3.10.2`, fixed in `3.8.32`, `3.9.18`, `3.10.2` · CVSS 5.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Weak cryptography or TLS, CWE-335
- [Atom-table exhaustion denial-of-service via JSON parse_document in MDEx](https://agentprime.io/advisories/GHSA-923r-7vf4-5vw8.md)
  `GHSA-923r-7vf4-5vw8`, `CVE-2026-53426`, `EEF-CVE-2026-53426` · Hex `mdex`: affected `>=0.4.3, <0.13.2`, fixed in `0.13.2` · CVSS 8.2 High · Not analysed yet · Published 29 Jun 2026 · Tags: Denial of service
- [Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)](https://agentprime.io/advisories/GHSA-4383-7xfp-gpph.md)
  `GHSA-4383-7xfp-gpph`, `CVE-2026-54889`, `EEF-CVE-2026-54889` · Hex `mdex`: affected `>=0.8.3, <0.13.2`, fixed in `0.13.2` · CVSS 5.1 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/ecosystem/hex.md>
Older: <https://agentprime.io/advisories/ecosystem/hex.md?cursor=WyIyMDI2LTA2LTI5VDE5OjEwOjQ5Ljg0MTAwMFoiLCJHSFNBLTQzODMtN3hmcC1ncHBoIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Hex&cursor=WyIyMDI2LTA4LTIxVDA5OjUxOjI1LjQxMjAwMFoiLCJHSFNBLXI4MnAtM3EycC03Mjh3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/hex/?cursor=WyIyMDI2LTA4LTIxVDA5OjUxOjI1LjQxMjAwMFoiLCJHSFNBLXI4MnAtM3EycC03Mjh3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.