| CVE-2026-89320 |
`HmacShaCryptor.Hash` never hashed its input
|
8.8
High
|
Oct 23, 2026 |
| CVE-2026-89319 |
`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and…
|
6.3
Medium
|
Oct 23, 2026 |
| CVE-2026-89318 |
`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking…
|
6.9
Medium
|
Oct 23, 2026 |
| CVE-2026-89317 |
gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it
|
6.3
Medium
|
Oct 23, 2026 |
| CVE-2026-89316 |
`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`
|
6.3
Medium
|
Oct 23, 2026 |
| CVE-2026-89315 |
`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" +…
|
6.9
Medium
|
Oct 23, 2026 |
| CVE-2026-89314 |
`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost…
|
6.9
Medium
|
Oct 23, 2026 |
| CVE-2026-89313 |
`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache
|
6.3
Medium
|
Oct 23, 2026 |
| CVE-2026-89312 |
`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length
|
6.9
Medium
|
Oct 23, 2026 |