plug_crypto vulnerabilities

CVEs whose affected-version data names the plug_crypto package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-105963Medium· 5.1

today

Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-type…

▾ Sunlitelixir-plug · plugvia CVEORG