CVEs published by EEF

CVEs published by EEF (CVE Numbering Authority). 35 tracked.

• CVE-2026-66883 MEDIUM 6.3 Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Auth
• CVE-2026-59247 HIGH 7.6 Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to sub
• CVE-2026-66884 LOW 2.1 Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.AuthorizationCa
• CVE-2026-65636 LOW 2.1 Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attack
• CVE-2026-53431 CRITICAL 9.1 Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained
• CVE-2026-54894 HIGH 7.5 UPGRADE Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unboun
• CVE-2026-55733 HIGH 7.5 UPGRADE Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unboun
• CVE-2026-55734 HIGH 7.5 UPGRADE Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions
• CVE-2026-55735 HIGH 7.5 UPGRADE Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to r
• CVE-2026-65635 HIGH 8.3 Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) all
• CVE-2026-54885 MEDIUM 6.9 Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cau
• CVE-2026-66297 HIGH 8.0 UPGRADE Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in live
• CVE-2026-66838 HIGH 8.2 UPGRADE Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-e
• CVE-2026-66881 HIGH 8.1 UPGRADE Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a
• CVE-2026-68746 HIGH 8.8 UPGRADE Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network
• CVE-2026-68749 HIGH 7.5 UPGRADE Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows
• CVE-2026-68750 HIGH 7.5 UPGRADE Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an
• CVE-2026-66298 HIGH 8.8 UPGRADE Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to
• CVE-2026-66296 MEDIUM 6.1 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected
• CVE-2026-66829 MEDIUM 6.1 UPGRADE URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitiz
• CVE-2026-66843 MEDIUM 6.1 UPGRADE Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sa
• CVE-2026-68747 MEDIUM 6.1 UPGRADE Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerabili
• CVE-2026-66370 MEDIUM 6.1 UPGRADE URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitiz
• CVE-2026-66885 MEDIUM 6.5 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authenticate a
• CVE-2026-67585 HIGH 8.7 Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an
• CVE-2026-69659 MEDIUM 5.5 UPGRADE Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of
• CVE-2026-64941 LOW 2.1 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in phoenixframework phoenix_live_view allows
• CVE-2026-70395 LOW 2.1 Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an att
• CVE-2026-107685 CRITICAL 9.1 Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an
• CVE-2026-105963 MEDIUM 5.1 Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plu
• CVE-2026-67579 HIGH 7.4 UPGRADE Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to injec
• CVE-2026-43971 MEDIUM 6.3 Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggli
• CVE-2026-93471 HIGH 8.7 Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an u
• CVE-2026-86696 HIGH 8.2 Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthe
• CVE-2026-105270 HIGH 8.7 Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an

← Back to latest CVEs