Jonatan Männchen / EEF

hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

Internal error terms inspected into AshTypescript RPC error responses

hex_core decompresses registry and Erlang term API responses without size limits

Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages

httpc leaks Authorization header to cross-origin redirect targets

Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1

beam_mcp: nested tool argument constraints advertised but not enforced

beam_mcp: JSON boolean and null tool arguments reach dispatch as strings

Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash

Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping