Advisories · Technology
hexpm.
Every CVE that names hexpm among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.3 Low
Refresh tokens accepted as private repository credentials at the CDN
- hexpm
- Authentication bypass
- CVSS 2.3 Low
Explicit organization scopes survive token refresh after membership ends
- hexpm
- Authentication bypass
- CVSS 8.3 High
OAuth token exchange grants repository scopes for organizations the principal cannot access
- hexpm
- Broken access control
- CVSS 7.1 High
Denial of Service via Oversized Package Upload
- hexpm
- Denial of service
- CVSS 9.5 CriticalCritical · CVSS 9+
Password Reset Tokens Do Not Expire
- hexpm
- hexpm hex.pm
- Authentication bypass
- CVSS 7.0 High
Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access
- hexpm
- hexpm hex.pm
- Broken access control
- CVSS 6.9 Medium
Path Traversal in Local File Store Backend
- hexpm
- Path traversal
- CVSS 8.5 High
Cross-site scripting (XSS) in OAuth Device Authorization screen
- hexpm
- hexpm hex.pm
- Cross-site scripting (XSS)