CVE-2026-105668

The hexpm hex package, versions 2.5.0 before 2.5.2 , is vulnerable to a Protection Mechanism Failure (CWE-693). The issue arises because retiring a locked release triggers a global cooldown bypass in Hex.RemoteConverger.build_cooldown_bypass/3 and Hex.RemoteConverger.unsafe_lock_bypass/1. This by...

EUVD-2026-97503

Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown cooldown config, HEXCOOLDOWN withholds versions younger than the configured ag...