Critical Erlang (Hex) package vulnerabilities
The Beam CVE database tracks 6 critical package advisories for Erlang (Hex): 6 critical severity. The newest is CVE-2026-48853, published Aug 25, 2026 and fixed in 1.0.0.
Critical-severity advisories for Erlang (Hex) packages from the GitHub Advisory Database, published since 2024. AI coding agents install packages on their own, so a vulnerable or malicious dependency can reach a project without a human picking it. Advisories for AI tools themselves are listed under each tool.
- Vulnerabilities tracked
- 6
- Critical
- 6
- Known exploited (CISA KEV)
- 0
- Published in the last 30 days
- 0
All entries, newest first
CVE-2026-48853 · Erlang (Hex)
gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads
critical9.2Aug 25, 2026CVE-2026-49757 · Erlang (Hex)
AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching
critical9.2Aug 25, 2026CVE-2026-49457 · Erlang (Hex)
QUIC has Broken TLS verification
critical9.1Jul 1, 2026CVE-2026-49454 · Erlang (Hex)
Relyra SAML SignatureValue not cryptographically verified -> authentication bypass
critical9.1Jun 26, 2026CVE-2026-8467 · Erlang (Hex)
PhoenixStorybook: Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground
critical9.5Jun 9, 2026CVE-2024-25718 · Erlang (Hex)
Samly access control vulnerability
critical9.1Feb 11, 2024