PO
Vendor
potatosalad
9
CVEs
0
On KEV
8
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-65630 New | JO jose potatosalad | 5.9 | Oct 26 | Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose |
| CVE-2026-65632 New | JO jose potatosalad | 5.1 | Oct 26 | ECDSA signature length is not validated in jose, allowing signature malleability |
| CVE-2026-65631 New | JO jose potatosalad | 6.9 | Oct 26 | erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service |
| CVE-2026-65629 New | JO jose potatosalad | 7.4 | Oct 26 | Weak PBKDF2 parameters for password-encrypted private-key export in jose |
| CVE-2026-65628 New | JO jose potatosalad | 5.9 | Oct 26 | Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types |
| CVE-2026-65627 New | JO jose potatosalad | 6.9 | Oct 26 | Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 |
| CVE-2026-65626 New | JO jose potatosalad | 5.9 | Oct 26 | Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose |
| CVE-2026-65625 New | JO jose potatosalad | 5.9 | Oct 26 | Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose |
| CVE-2023-50966 | ER Erlang-jose Potatosalad | 5.3 | Mar 19 | erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header |