CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 26/10/2026 |
| CVE-2026-34986 | HIGH7.5 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field in | 06/04/2026 |
| CVE-2025-27144 | MEDIUM6.6 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE c | 24/02/2025 |
| CVE-2024-28180 | MEDIUM4.3 | Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data wo | 09/03/2024 |
| GHSA-2c7c-3mj9-8fqh | MEDIUM | Decryption of malicious PBES2 JWE objects can consume unbounded system resources | 21/11/2023 |
| GO-2023-2334 | Denial of service via decryption of malicious PBES2 JWE objects in github.com/go-jose/go-jose/v3 | 21/11/2023 |