hexpm hex.pm

• CVE-2026-21622 Critical 9.5 Password Reset Tokens Do Not Expire 0.4%
• CVE-2026-21621 High 7.0 Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access 0.4%
• CVE-2026-21618 High 8.5 Cross-site scripting (XSS) in OAuth Device Authorization screen 0.3%