E
Vendor security profile1 actively exploited CVEs
erlang
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs53
Critical3
CISA KEV1
Public exploit2
Patch rate%98
Avg. CVSS6.9
12-month vulnerability rate
0
0
0
0
3
4
3
7
14
0
19
2
CVE KEV
CVE severity distribution
53toplam CVE
Critical3 (6%)
High28 (53%)
Medium17 (32%)
Low4 (8%)
Uncertain1 (2%)
Patch and exploitation view
%98
Verified patch
%2
CISA KEV
%4
Public exploit
51Patch available
1Partial
1Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
2.1
CVE-2026-105274
hex_core decompresses registry and Erlang term API responses without size limits
E
Patch verifiedEPSS %0
7.5
CVE-2026-103060
Path traversal in rebar3 via unvalidated dependency app names
E
Patch verifiedEPSS %0
8.2
CVE-2026-65634
Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder
E
Patch verifiedEPSS %0
7.1
CVE-2026-68956
SSH daemon allocates unbounded idle session channels, bypassing max_channels
E
Patch verifiedEPSS %0
9.3
CVE-2026-89422
TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension
E
Patch verifiedEPSS %0
8.7
CVE-2026-69664
httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
E
Patch verifiedEPSS %1
6.3
CVE-2026-70409
eldap does not bound the port component of a referral URL before integer conversion
E
Patch verifiedEPSS %1
6.3
CVE-2026-70405
snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields
E
Patch verifiedEPSS %1
8.2
CVE-2026-66835
httpd mod_auth directory protection bypassed by a doubled slash in the request path
E
Patch verifiedEPSS %1
8.2
CVE-2026-73270
httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems
E
Patch verifiedEPSS %1