Skip to content

Product

hex_core vulnerabilities

2 published CVES affecting hex_core, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
0
Low
1
Unscored
0
CISA KEV
0

Latest hex_core CVEs

Newest publication first

  1. CVE-2026-21619 Unsafe Deserialization of Erlang Terms in hex_core

    Published
    LowCVSS 2.0 EPSS 0.64%

    Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program...

  2. CVE-2019-1000013 Hex authenticity of signed packages not validated

    Published
    HighCVSS 8.8 EPSS 0.88%

    Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from m...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.