Phoenix
Vendor:
First CVE: Nov 17, 2017 · Active for 8 years
5
Total CVEs
More Total CVEs than 77% of tracked products
1.7
Avg CVEs / Year
Higher CVE frequency than 59% of tracked products
7.5
Avg CVSS
Higher Avg CVSS than 50% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Phoenix over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 17, 2017
8 years ago
Most Recent CVE
Jul 7, 2026
17 days ago
CVE Severity & Scoring
Phoenix5 CVEs
20%
80%
All CVEs352,231 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network5 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low5 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None4 (80.0%)
Unknown0 (0.0%)
Required1 (20.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None5 (100.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-56811HIGH Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket module) allows an unauthenticated attacker to cause a denial of servi | Jul 7, 2026 | 7.5 | 33 | NO | NO |
CVE-2026-56812HIGH Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause | Jul 7, 2026 | 7.5 | 30 | NO | NO |
CVE-2026-32689HIGH Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix allows a denial of service via the long-poll transport's NDJSON body handling.
In 'E | May 5, 2026 | 8.7 | 30 | NO | NO |
CVE-2017-1000163MEDIUM The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or | Nov 17, 2017 | 6.1 | 29 | NO | YES |
CVE-2022-42975HIGH socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF t | Oct 17, 2022 | 7.5 | 25 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (5 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
20.0% of CVEs· 98th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (5 CVEs).
Media Mentions
Signals from CVEs in this product scope (5 CVEs).
Top CNAs Publishing CVEs For Phoenix
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.3.0-rc.0 | 1 | 6.1 | 2.4% | 0 | 1 |
| 1.2.2 | 1 | 6.1 | 2.4% | 0 | 1 |
| 1.2.0 | 1 | 6.1 | 2.4% | 0 | 1 |
| 1.1.6 | 1 | 6.1 | 2.4% | 0 | 1 |
| 1.1.5 | 1 | 6.1 | 2.4% | 0 | 1 |
| 1.1.4 | 1 | 6.1 | 2.4% | 0 | 1 |
| 1.1.3 | 1 | 6.1 | 2.4% | 0 | 1 |
| 1.1.2 | 1 | 6.1 | 2.4% | 0 | 1 |
| 1.1.1 | 1 | 6.1 | 2.4% | 0 | 1 |
| 1.1.0 | 1 | 6.1 | 2.4% | 0 | 1 |
| 1.0.4 | 1 | 6.1 | 2.4% | 0 | 1 |
| 1.0.3 | 1 | 6.1 | 2.4% | 0 | 1 |
| 1.0.2 | 1 | 6.1 | 2.4% | 0 | 1 |
| 1.0.1 | 1 | 6.1 | 2.4% | 0 | 1 |
| 1.0.0 | 1 | 6.1 | 2.4% | 0 | 1 |