Sources:
amazon_linux
archlinux
azure_linux
bitnami_vulndb
capec
capec_enrichment_dashboard
certeu
certfr
circl_kev
cisa_known_exploited
cna_scorecard
cnvd
csaf_abb
csaf_adstecindustrialitgmbh
csaf_amd
csaf_aumariestergmbhcokg
csaf_baadem2mproductsgmbh
csaf_beckhoffautomationgmbhcokg
csaf_bendergmbhcokg
csaf_bosch
csaf_bsi
csaf_bsi_aggregator
csaf_bsi_cvd_white
csaf_bsi_white
csaf_bsi_wid_white
csaf_carlogavazziautomation
csaf_certbund
csaf_certvde
csaf_cisa
csaf_cisa_it
csaf_cisa_ot
csaf_cisco
csaf_claaskgaa
csaf_codesysgmbh
csaf_dell
csaf_duraggmbh
csaf_endresshauserag
csaf_ericsson
csaf_euchnergmbhcokg
csaf_festosecokg
csaf_frauschersensortechnikgmbh
csaf_hancom
csaf_harmaninternational
csaf_helmholzgmbhcokg
csaf_himapaulhildebrandtgmbh
csaf_hitachi
csaf_hpe
csaf_huawei
csaf_hydacinternationalgmbh
csaf_ibm
csaf_ifmelectronicgmbh
csaf_janitzaelectronicsgmbh
csaf_jumogmbhcokg
csaf_juniper
csaf_kebautomationkg
csaf_kukaag
csaf_lenovo
csaf_lenzese
csaf_mbconnectlinegmbh
csaf_mettlertoledogmbh
csaf_metzconnectgmbh
csaf_microsoft
csaf_mieleciekg
csaf_moxa
csaf_murrelektronikgmbh
csaf_ncscnl
csaf_ndaal
csaf_netapp
csaf_nozomi
csaf_nozominetworks
csaf_nvidia
csaf_opcfoundation
csaf_openeuler
csaf_opensuse
csaf_oracle
csaf_ox
csaf_paloalto
csaf_panasonic
csaf_pentagrid
csaf_pepperlfuchsse
csaf_phoenix
csaf_pilzgmbhcokg
csaf_qnap
csaf_redhat
csaf_samsung
csaf_sauterag
csaf_schneider
csaf_sick
csaf_siemens
csaf_smasolartechnologyag
csaf_suse
csaf_swarcotrafficsystemsgmbh
csaf_synology
csaf_tibco
csaf_trend
csaf_trumpfsecokg
csaf_trustsource
csaf_tuxcare
csaf_ubiquiti
csaf_vartastoragegmbh
csaf_vegagrieshaberkg
csaf_vmware
csaf_wagogmbhcokg
csaf_weidmuellerinterfacegmbhcokg
csaf_welotecgmbh
csaf_wiesemanntheisgmbh
csaf_yaskawaeuropegmbh
csaf_yokogawa
csaf_zyxel
cve_forecast
cve_icu
cve_vs_github_dashboard
cvelistv5
cwe_dashboard
cwe_enrichment
cwec
debian_rustsec
debian_security_tracker
drupal
emb3d
emb3d_dashboard
epss_dashboard
epss_history
epss_kev_enrichment
euvd_kev
fedora
fkie_nvd
freebsd
gcve
gcve_enriched
gcve_enrichment
gcve_enrichment_dashboard
gentoo
github
gsd
jvn
kev_ransomware
mitre_attack
moksha
ndaal_kev
netbsd
nuclei_dashboard
nuclei_enrichment
nvd
nvd_cpe_dictionary
openbsd
opencve
oracle_linux
ossf_malicious_packages
osv_almalinux
osv_alpine
osv_android
osv_bellsoft
osv_chainguard
osv_cran
osv_github_actions
osv_golang
osv_haskell
osv_hex
osv_linux
osv_maven
osv_npm
osv_nuget
osv_ocaml
osv_ossfuzz
osv_packagist
osv_pub
osv_rocky
osv_rubygems
osv_rustsec
osv_swift
osv_ubuntu
osv_wolfi
publish_stats
pysec
sadp_pilot
ssvc
ssvc_dashboard
tailscale
tsunami_enrichment
variot
vulncheck_kev
vulnrichment
Clear
| ID | Title | Severity | CVSS | Source | Updated |
|---|---|---|---|---|---|
| eef-cve-2026-118391 | Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto | UNKNOWN | 8.9 | osv_hex | unknown |
| eef-cve-2026-110826 | AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change | UNKNOWN | 6.3 | osv_hex | unknown |
| eef-cve-2026-119215 | AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account | UNKNOWN | 7.6 | osv_hex | unknown |
| eef-cve-2026-118505 | AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource | UNKNOWN | 6.3 | osv_hex | unknown |
| eef-cve-2026-117680 | jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not | UNKNOWN | 2.1 | osv_hex | unknown |
| eef-cve-2026-117656 | Unverified Sign in with Apple callback parameter can override verified ID token claims | UNKNOWN | 9.3 | osv_hex | unknown |
| eef-cve-2026-117666 | ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary | UNKNOWN | 9.1 | osv_hex | unknown |
| eef-cve-2026-117645 | Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1 | UNKNOWN | 5.3 | osv_hex | unknown |
| eef-cve-2026-116078 | HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit | UNKNOWN | 8.7 | osv_hex | unknown |
| eef-cve-2026-109823 | Host filesystem path disclosure via DNS rebinding | UNKNOWN | 2.3 | osv_hex | unknown |
| eef-cve-2026-65628 | Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types | UNKNOWN | 5.9 | osv_hex | unknown |
| eef-cve-2026-65632 | ECDSA signature length is not validated in jose, allowing signature malleability | UNKNOWN | 5.1 | osv_hex | unknown |
| eef-cve-2026-65631 | erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service | UNKNOWN | 6.9 | osv_hex | unknown |
| eef-cve-2026-65630 | Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose | UNKNOWN | 5.9 | osv_hex | unknown |
| eef-cve-2026-65629 | Weak PBKDF2 parameters for password-encrypted private-key export in jose | UNKNOWN | 7.4 | osv_hex | unknown |
| eef-cve-2026-65627 | Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 | UNKNOWN | 6.9 | osv_hex | unknown |
| eef-cve-2026-65626 | Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose | UNKNOWN | 5.9 | osv_hex | unknown |
| eef-cve-2026-65625 | Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose | UNKNOWN | 5.9 | osv_hex | unknown |
| eef-cve-2026-113440 | HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney | UNKNOWN | 6.0 | osv_hex | unknown |
| eef-cve-2026-97200 | Unbounded response body buffering and decompression in hackney | UNKNOWN | 8.2 | osv_hex | unknown |
| eef-cve-2026-115700 | SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney | UNKNOWN | 6.9 | osv_hex | unknown |
| eef-cve-2026-115693 | Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney | UNKNOWN | 9.1 | osv_hex | unknown |
| eef-cve-2026-112880 | CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney | UNKNOWN | 2.1 | osv_hex | unknown |
| eef-cve-2026-115269 | HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit | UNKNOWN | 8.7 | osv_hex | unknown |
| eef-cve-2026-109584 | HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit | UNKNOWN | 8.7 | osv_hex | unknown |
| eef-cve-2026-114216 | Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit | UNKNOWN | 6.3 | osv_hex | unknown |
| eef-cve-2026-114213 | WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit | UNKNOWN | 8.7 | osv_hex | unknown |
| eef-cve-2026-113436 | Quadratic bignum parsing of Content-Length and Host port values in Bandit | UNKNOWN | 8.7 | osv_hex | unknown |
| eef-cve-2026-111103 | HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit | UNKNOWN | 8.2 | osv_hex | unknown |
| eef-cve-2026-111101 | HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit | UNKNOWN | 8.7 | osv_hex | unknown |