plug

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

1. Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)CVE-2026-56814elixir-plug · CVSS 6.9 · 1.1% likely

   CWE-770

2. Plug: quadratic-time decoding of nested query/body parameters enables denial of serviceCVE-2026-54892elixir-plug · CVSS 8.7 · 0.9% likely

   CWE-407

3. Unbounded buffer accumulation in multipart header parsing causes denial of service in plugCVE-2026-8468elixir-plug · CVSS 8.2 · 0.6% likely

   CWE-770

4. Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto argumentsCVE-2026-105963elixir-plug · CVSS 5.1 · 0.5% likely

   CWE-532

5. Cookie attribute injection in Plug.Conn.Cookies.encode/2CVE-2026-56813elixir-plug · CVSS 2.1 · 0.2% likely

   CWE-141

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.