H
Vendor security profile
hex
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs27
Critical2
CISA KEV0
Public exploit6
Patch rate%93
Avg. CVSS6.3
12-month vulnerability rate
0
0
1
0
1
0
1
10
2
3
1
8
CVE KEV
CVE severity distribution
27toplam CVE
Critical2 (7%)
High11 (41%)
Medium10 (37%)
Low4 (15%)
Patch and exploitation view
%93
Verified patch
%0
CISA KEV
%22
Public exploit
25Patch available
0Partial
0Workaround
0Vendor: no patch
2Unknown
Latest vulnerabilities
5.9
CVE-2026-96596
erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
E
Patch verified
2.1
CVE-2026-105274
hex_core decompresses registry and Erlang term API responses without size limits
E
Patch verifiedEPSS %0
2.3
CVE-2026-81856
Terminal escape sequence injection in Hex via unneutralized server-supplied output
H
Patch verifiedEPSS %0
7.5
CVE-2026-96612
Path traversal in Hex via unvalidated dependency app names
H
Patch verifiedEPSS %0
7.1
CVE-2026-105668
Hex release-age cooldown is lifted package-wide when the locked release is retired
H
Patch verifiedEPSS %0
6.9
CVE-2026-105280
Hex writes unverified package tarballs to standard output in mix hex.package fetch
H
Patch verifiedEPSS %0
2.1
CVE-2026-96618
Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror
H
Patch verifiedEPSS %0
5.9
CVE-2026-103503
Hex trusts its bundled CA certificates when cacerts_path is set
H
Patch verifiedEPSS %0
5.9
CVE-2026-103502
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
H
Patch verifiedEPSS %0
-
CVE-2026-54892
Plug: quadratic-time decoding of nested query/body parameters enables denial of service
H
Patch status unknownEPSS %1