gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads

Summary GRPC.Codec.Erlpack.decode/2 calls :erlang.binarytoterm/1 directly on the raw gRPC message body without the :safe option. Any unauthenticated peer that can reach a gRPC endpoint with Content-Type: application/grpc+erlpack can crash the entire BEAM node via atom table exhaustion or, if a...

EUVD-2026-37015

gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads...

GHSA-GRP7-V8XH-RJ7H gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads

Summary GRPC.Codec.Erlpack.decode/2 calls :erlang.binarytoterm/1 directly on the raw gRPC message body without the :safe option. Any unauthenticated peer that can reach a gRPC endpoint with Content-Type: application/grpc+erlpack can crash the entire BEAM node via atom table exhaustion or, if a...

Malicious Package

Overview tinkoff-boxy-atom-text-link is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview tinkoff-pfp-atom-styles-tiles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview dolyame-boxy-atom-bnpl-store-button is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

GHSA-43HJ-FXWJ-49QW membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

Summary membranemp4plugin interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, with no validation against an allow-list. Any code path that calls Membrane.MP4.Container.parse/1 or the bang variant on attacker-controlled MP4 bytes can be made to exhaust the BEAM atom...

EUVD-2026-36235

membranemp4plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion...

membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

Summary membranemp4plugin interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, with no validation against an allow-list. Any code path that calls Membrane.MP4.Container.parse/1 or the bang variant on attacker-controlled MP4 bytes can be made to exhaust the BEAM atom...

CVE-2026-50105

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105

The Git repository management system Gitea contains a vulnerability in its RSS and Atom feed handlers due to a lack of access control. This flaw allows an attacker to bypass API-token scope and public-only confinement , potentially leading to information disclosure or an increase in privileges . ...

CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105: Exposure of Sensitive Information to an Unauthorized Actor

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-67585

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys. Every key of every object in the representations argument of the federation-mandated...

EEF-CVE-2026-67585 Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation

Summary Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys. Every key of every object in the representations argument of the federation-mandat...

CVE-2026-67585

The CVE-2026-67585 entry concerns DivvyPayHQ absinthe_federation. An unauthenticated remote attacker can cause the Erlang VM to abort by crafting _entities representation keys. The root cause is that every key in representations is converted to an atom via String.to_atom/1, and since representati...