Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.9Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in BanditEPSS 0.5%Oct 15, 2026
- Medium5.9erl_tar:extract/2 loops forever on a GNU sparse member with a trailing holeEPSS 0.2%Oct 14, 2026
- High8.7HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in BanditEPSS 0.5%Oct 14, 2026
- Low2.1hex_core decompresses registry and Erlang term API responses without size limitsEPSS 0.4%Oct 12, 2026
- Unknownhex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25EPSS 0.2%Oct 12, 2026
- UnknownInternal error terms inspected into AshTypescript RPC error responsesEPSS 0.3%Oct 12, 2026
- Medium6.9Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoSEPSS 0.1%Oct 10, 2026
- High8.2Uncontrolled RecursionEPSS 0.4%Oct 9, 2026
- UnknownAsh.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sortsEPSS 0.3%Oct 9, 2026
- UnknownOAuth2 sign-in attached to an existing account without an email comparison in AshAuthenticationSep 17, 2026
- UnknownRevoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication PhoenixSep 17, 2026
- Medium6.3HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2EPSS 0.5%Jun 8, 2026
- Low2.1Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1May 11, 2026
13 records · page 1 of 1
PreviousNext