CVE-2026-65628

The jose library (versions 1.5.0 before 1.11.13 ) is vulnerable to a CPU denial-of-service via infinite recursion in the jose_jwk:shared_secret/2 function (exposed as JOSE.JWK.shared_secret/2). The vulnerability occurs because the fallback clause re-invokes itself with identical arguments when pr...

EUVD-2026-54084

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name...