phoenixframework vulnerabilities
6 published CVEs name phoenixframework among the affected products.
- 6Published CVEs6 of them scored
- 6Last 12 monthspublished in the last year
- 0Critical2 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-117645
Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
phoenixframework · phoenix_html
Medium5.3 - CVE-2026-64941
Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR
phoenixframework · phoenix_live_view
Low2.1 - CVE-2026-58228
Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
phoenixframework · phoenix_live_view
Medium5.1 - CVE-2026-56812
Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff
phoenixframework · phoenix
Medium6.3 - CVE-2026-56811
Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service
phoenixframework · phoenix
High8.7 - CVE-2026-32689
Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix
phoenixframework · phoenix
High8.7