Get real-time updates on Telegram
CVE-2026-75542: hexpm 2025-10-18 to before 2026-08-24
CVE-2026-75542. EPSS 0.00465 (percentile 0.38405), scored 11-Oct-2026.
Affected technology
hexpm · 2025-10-18 to before 2026-08-24
hexpm
hexpm · 71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b to before bf0fb9d208f0acfabf7a2f7467c8231659e322a8
hexpm
Component: 'Elixir.HexpmWeb.API.OAuthController', 'Elixir.Hexpm.OAuth.Tokens'
Function: 'Elixir.HexpmWeb.API.OAuthController':validate_scopes_against_key/2, 'Elixir.Hexpm.OAuth.Tokens':create_for_org/6
File: lib/hexpm_web/controllers/api/oauth_controller.ex, lib/hexpm/oauth/tokens.ex
Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
Source advisory’s CVSS 4.0 assessment (base score 8.3/10) rates confidentiality impact as high; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.
- CWE
- CWE-863
- CCR priority
- 0.1 /100 (P5)
- EPSS
- 0.00465 · percentile 0.38427 · 2026-10-12
- KEV
- no
Provenance
- FIRST EPSS daily exploit-probability · Source record · observed 2026-10-13 01:52:16.607887+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-13 01:49:08.152775+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-75542.html