Advisories · Technology
hex.
Every CVE that names hex among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.3 Low
Terminal escape sequence injection in Hex via unneutralized server-supplied output
- hex
- CWE-150
- CVSS 7.5 High
Path traversal in Hex via unvalidated dependency app names
- hex
- Path traversal
- CVSS 7.1 High
Hex release-age cooldown is lifted package-wide when the locked release is retired
- hex
- CWE-693
- CVSS 6.9 Medium
Hex writes unverified package tarballs to standard output in mix hex.package fetch
- hex
- CWE-354
- CVSS 2.1 Low
Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror
- hex
- Denial of service
- CWE-409
- CVSS 5.9 Medium
Hex trusts its bundled CA certificates when cacerts_path is set
- hex
- Weak cryptography or TLS
- CVSS 8.9 High
Lockfile checksums not verified in Hex allows dependency integrity bypass
- hex
- CWE-354
- CWE-494