CVE-2026-65629

Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a password-encrypted private key with josejwk:toder/2...

CVE-2026-116575 Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, buildsessionscope in mem0/memory/main.py and Memory.buildSessionScope in the TypeScript SDK join caller-controlled userid, agentid, and runid values using unescaped ...

CVE-2026-116575

The Mem0 persistent memory infrastructure for AI agents is vulnerable to a cross-tenant conversation leak due to an unescaped delimiter collision in the session-scope key. Specifically, the _build_session_scope() function in the Python SDK (prior to 2.0.18 ) and Memory.buildSessionScope() in the ...

CVE-2026-65630

Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursiv...

EEF-CVE-2026-65630 Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose

Summary Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a...

CVE-2026-65630 Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose

Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursiv...

EUVD-2026-110311

Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursiv...

CVE-2026-65630 Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose

Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursiv...

CVE-2026-65630

The potatosalad jose library (versions 1.10.0 before 1.11.13 ) contains an Observable Timing Discrepancy (CWE-208) in its pure-Erlang Curve25519 fallback. The vulnerability arises because the recursive Montgomery ladder uses value-dependent Erlang bignum arithmetic (multiplication, remainder, and...

CVE-2026-65631

Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the public josejwk:frombinary/1 or josejwk:frommap/1 API or the...

EUVD-2026-110309

Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the public josejwk:frombinary/1 or josejwk:frommap/1 API or the...

CVE-2026-65629 Weak PBKDF2 parameters for password-encrypted private-key export in jose

Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a password-encrypted private key with josejwk:toder/2...

CVE-2026-65629 Weak PBKDF2 parameters for password-encrypted private-key export in jose

Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a password-encrypted private key with josejwk:toder/2...

EUVD-2026-110308

Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a password-encrypted private key with josejwk:toder/2...

EEF-CVE-2026-65629 Weak PBKDF2 parameters for password-encrypted private-key export in jose

Summary Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a password-encrypted private key with...

CVE-2026-65629

Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a password-encrypted private key with josejwk:toder/2...

CVE-2026-65629

The jose library (versions 1.10.0 to before 1.11.13) is vulnerable to an offline password-cracking attack due to weak PBKDF2 parameters used during private-key export via jose_jwk:to_der/2. The jose_jwk_der:to_binary/3 function in src/jwk/jose_jwk_der.erl uses a hardcoded iteration count of 2048 ...

EEF-CVE-2026-65628 Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types

Summary josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Becau...

CVE-2014-125135

A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address...

CVE-2014-125135 OctoPrint Flask Secret Key hard-coded key

A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address...