332 matches found
CVE-2026-66838
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...
EUVD-2026-54476
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...
CVE-2026-66838 SQL injection via the :comment option in Postgrex.stream/4
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...
CVE-2026-65636
The CVE-2026-65636 issue affects the ymlr library (Elixir.Ymlr) and its document encoding entry points (Ymlr.document!/2, Ymlr.documents!/2, Ymlr.documents/2). An attacker-controlled comment string is interpolated behind a single #, and CRLF sequences terminate the YAML comment, allowing injectio...
CVE-2026-65636 YAML injection via unescaped newlines in ymlr document comments
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...
EUVD-2026-51537
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...
CVE-2026-65636
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...
CVE-2026-65636 YAML injection via unescaped newlines in ymlr document comments
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...
PT-2026-66757
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...
EUVD-2026-51144
Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.registerclient/3 forwards caller-supplied...
CVE-2026-59694 Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per payment by a large multiplier, degrading the sponsor's operating margin. When the mpp Elixir library is configured as fee payer feepayer: true,...
CVE-2026-54451
creationtimestamp| type| source ---|---|--- 2026-07-15 18:35:03+00:00| published-proof-of-concept| https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-rv48-qqj5-crxg...
CVE-2026-58229
Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. The Mint.HTTP1.decodeheaders/5 and Mint.HTTP1.decodetrailerheaders/4 functions in lib/mint/http1.ex accumulate every parsed...
CVE-2026-59246 Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory
Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client host and cause a denial of service. The Mint.HTTP2.handlecontinuation/3 function in lib/mint/http2.ex accumulates the header-block fragment carried by each HTTP/2...
EEF-CVE-2026-58229 Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS
Summary Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. The Mint.HTTP1.decode\headers/5 and Mint.HTTP1.decode\trailer\headers/4 functions in lib/mint/http1.ex accumulate every...
EUVD-2026-42876
Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes. The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value a...
EUVD-2026-42867
SQL Injection vulnerability in elixir-ecto postgrex allows an attacker who can influence a LISTEN channel name to inject SQL into the reconnect replay query, causing a denial of service of the notification connection. Postgrex.Notifications sanitizes channel names with quotechannel/1, which doubl...
EUVD-2026-34012
Tesla vulnerable to multipart part smuggling via unescaped content-disposition values...