| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-65629 | - | Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a passwo | 2026-10-27 15:00:49 | 2026-10-26 20:17:58 |
| CVE-2026-65628 | - | jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type (kty) module, and its fallback clause re-invokes itsel | 2026-10-27 15:00:49 | 2026-10-26 20:17:58 |
| CVE-2026-65627 | - | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function in src/jwe/jo | 2026-10-27 15:00:49 | 2026-10-26 20:17:58 |
| CVE-2026-65626 | - | The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the recovered message when a decrypted block has valid PKCS#1 v1.5 padding (a leading 0x00 0x02, a padding string | 2026-10-27 15:00:49 | 2026-10-26 20:17:58 |
| CVE-2026-65625 | - | The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no | 2026-10-27 15:00:49 | 2026-10-26 20:17:57 |
| CVE-2026-104598 | - | libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c. This allows a remote attacker to obtain sensitive information. | 2026-10-27 15:00:49 | 2026-10-26 20:17:37 |
| CVE-2026-104597 | - | libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information. | 2026-10-27 15:00:49 | 2026-10-26 20:17:37 |
| CVE-2026-104596 | - | libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information. | 2026-10-27 15:00:49 | 2026-10-26 20:17:37 |
| CVE-2026-116638 | - | The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be ab | 2026-10-27 15:00:49 | 2026-10-26 19:16:31 |
| CVE-2026-116632 | 5.4 | A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1. | 2026-10-27 15:00:49 | 2026-10-26 19:16:30 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39679
Zapisa po stranici: