elixir-plug plug crypto vulnerabilities

Latest elixir-plug plug crypto CVEs

Newest publication first

1. CVE-2026-105963 Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

   Published 2026-10-23

   Medium·CVSS 5.1

   Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every public function in Plug.C...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.