Login Request a demo
PL
Product
plug
by elixir-plug · last CVE Oct 23, 2026
4
CVEs
0
On KEV
8.7
Max CVSS
1
New 30D
Vulnerabilities4In the news0Timeline
Severity mix
Critical 0High 1Medium 2Low 1
Severity
All severities4Critical0High1Medium2Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add plug to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-54892
8.7
1%
Jun 23
Plug: quadratic-time decoding of nested query/body parameters enables denial of service
Affected: 1.15.0 before 1.15.5; 1.16.0 before 1.16.4; 1.17.0 before 1.17.2; 1.18.0 before 1.18.3; 1.19.0 before 1.19.3; 712b875d3442c765d8d37e546ffd5ad9f8afcc55
CVE-2026-56814
6.9
1%
Jul 10
Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)
Affected: 1.4.0-rc.0 before 1.16.6; 1.17.0 before 1.17.4; 1.18.0 before 1.18.5; 1.19.1 before 1.19.5; 1.20.0 before 1.20.3; c52b2f32c90bccd718202bafccb5f95594e30183
CVE-2026-105963
New
5.1
1%
Oct 23
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Affected: 1.6.3 before 1.7.0; 56000c33d8a0a2fbac491f8be06b9c5112bc2276
CVE-2026-56813
2.1
0%
Jul 10
Cookie attribute injection in Plug.Conn.Cookies.encode/2
Affected: 0.1.0 before 1.16.6; 1.17.0 before 1.17.4; 1.18.0 before 1.18.5; 1.19.1 before 1.19.5; 1.20.0 before 1.20.3; f26876aa67aaeb38e616638aa3efbcc2fe2906a5
Showing 4