Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 08:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

181-70% vs 7-day avg of 599

2 critical, 65 high, 73 medium, 31 low

Expand	Severity	Score	Advisory	Title	Source	Flags	Published
	Medium	5.1	CVE-2026-105963	Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose... elixir-plugelixir-plug plug, elixir-plug plug_crypto	NVD		Oct 23 10:16 UTC
CVE-2026-105963Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose... Executive summary A flaw in the Elixir libraries plug and plug_crypto can cause the application's secret key base, or another compared secret, to be written into application logs and error tracker reports when a request supplies a wrong-typed value. The advisory rates it MEDIUM with a CVSS 4.0 score of 5.1. The fix is to upgrade plug to 1.7.0 or later and plug_crypto to 2.2.1 or later, and the advisory also gives code-level workarounds. Technical summary The weakness is CWE-532, insertion of sensitive information into a log file, caused by failed function-head guards in Plug.Crypto that make the Erlang VM raise FunctionClauseError with argument values in the top stack frame. An unauthenticated remote attacker can trigger it with one request, such as a bracket-syntax query parameter passed to Phoenix.Token.verify/4 or a missing request header compared with secure_compare/2, but reading the leaked value requires access to the logs or an error tracker. Affected versions are plug from 1.6.3 before 1.7.0 and plug_crypto from 1.0.0 before 2.2.1, with git ranges also listed. Fixed versions are plug 1.7.0 and plug_crypto 2.2.1, and the advisory's fix commits are aeaa90e in plug and 9818874 in plug_crypto. Workarounds include checking argument types before calling Plug.Crypto, treating missing headers as failed comparisons, and configuring the error tracker to drop stack-frame arguments, though the local log still holds the value. The advisory does not state whether the issue has been exploited in the wild, and it does not state any detection guidance beyond the affected configurations described. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cna.erlef.org/cves/CVE-2026-105963.html Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects elixir-plug elixir-plug plug elixir-plug plug_crypto NIST National Vulnerability DatabasePublished Oct 23, 2026 10:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee