hexpm vulnerabilities
Every vulnerability this feed holds for hexpm, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.
7 vulnerabilities tracked.
- 7.5 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package…
- 7.1 Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's…
- 6.9 Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix…
- 5.9 Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate…
- 2.3 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile…
- 2.1 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hexcore allows an untrusted repository mirror, or a…
- 2.1 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that hexpm is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other vendors tracked here
Microsoft Linux Red Hat IBM n/a Apple Google Apache Software Foundation Oracle Corporation zephyrproject Unknown FFMPEG Adobe Drupal SAP_SE Cisco Eclipse Foundation OpenEMR go-vikunja hickory-dns n8n-io Hitachi Grafana HCL Software