EUVD-2026-37015

gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads...

CVE-2026-47080

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause for :cdata...

CVE-2026-47079 Round-trip Corruption via Improper Entity Escaping in xml_builder

Inappropriate Encoding for Output Context vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2,...

EEF-CVE-2026-47079 Round-trip Corruption via Improper Entity Escaping in xml_builder

Summary Inappropriate Encoding for Output Context vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2,...

CVE-2026-47079 Round-trip Corruption via Improper Entity Escaping in xml_builder

Inappropriate Encoding for Output Context vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2,...

CVE-2026-47079

CVE-2026-47079 is an improper entity-escaping vulnerability in the joshnuss xml_builder Elixir library (versions 0.0.6 through before 2.4.1 ). The XmlBuilder.generate/1 function fails to escape literal & characters when followed by entity-like tokens (lt;, gt;, amp;, quot;, apos;). Attacker-suppl...

EUVD-2026-63879

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2,...

CVE-2026-48590 Element and Attribute Names Injected Verbatim into XML Output in xml_builder

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2,...

CVE-2026-48590

CVE-2026-48590 is an XML Injection vulnerability in the Elixir library xml_builder (by joshnuss), affecting versions 0.0.1 through before 2.4.1 . The root cause is that element names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without escapin...

EEF-CVE-2026-48590 Element and Attribute Names Injected Verbatim into XML Output in xml_builder

Summary XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2,...

CVE-2026-47080 CDATA Section Breakout via Unsanitised ]]> in xml_builder

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause for :cdata...

CVE-2026-47080 CDATA Section Breakout via Unsanitised ]]> in xml_builder

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause for :cdata...

CVE-2026-47080 CDATA Section Breakout via Unsanitised ]]> in xml_builder

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause for :cdata...

CVE-2026-47080

CVE-2026-47080 is an XML Injection vulnerability in the joshnuss xml_builder Elixir library (versions 0.0.7 through before 2.4.1 ). The root cause is in XmlBuilder.escape/1 within lib/xml_builder.ex: when handling {:cdata, data}, the data is placed verbatim between without splitting on embedded ...

EEF-CVE-2026-47080 CDATA Section Breakout via Unsanitised ]]> in xml_builder

Summary XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause fo...

CVE-2026-66838

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...

CVE-2026-66838 SQL injection via the :comment option in Postgrex.stream/4

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...

EUVD-2026-54476

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...

PT-2026-69037

Name of the Vulnerable Software and Affected Versions postgrex versions 0.19.3 through 0.22.3 Description An SQL Injection issue exists in the postgrex library used by elixir-ecto. The flaw occurs when the :comment option is used within the Postgrex.stream/4 function or the Ecto.Repo.stream/2...

CVE-2026-66838: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...