hex oban_web vulnerabilities

Latest hex oban_web CVEs

Newest publication first

1. CVE-2026-48592 Missing authorization check on save-job event handler in oban_web

   Published 2026-05-26

   Medium·CVSS 5.3 EPSS 0.50%

   Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution. The handle_event("save-job", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does not perform an authorization check, unlik...

2. CVE-2026-48593 Unbounded range expansion in cron describe causes memory exhaustion in oban_web

   Published 2026-05-26

   Medium·CVSS 5.9 EPSS 0.42%

   Uncontrolled Resource Consumption vulnerability in oban-bg oban_web ('Elixir.Oban.Web.CronExpr' modules) allows memory exhaustion via unbounded cron range expansion. An attacker with access to schedule cron jobs can submit a malicious cron expression such as "0 0 1-100000000 * *"...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.