phoenixframework

Products

Exploited and recent CVEs

• CVE-2026-117645 Medium 5.3 Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1 0.3%
• CVE-2026-64941 Low 2.1 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR 0.6%
• CVE-2026-58228 Medium 5.1 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link> 0.5%
• CVE-2026-56812 Medium 6.3 Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff 0.8%
• CVE-2026-56811 High 8.7 Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service 0.8%
• CVE-2026-32689 High 8.7 Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix 0.5%