Vulnerabilidades exploráveis hoje
413,917na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,779
Novos KEV · 24H0
Exploit Today ≥ 701,707
Distribuição · última janela
- Crítica5,603
- Alta22,493
- Média20,818
- Baixa2,138
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2018-4779——
——0Rejected reason: This candidate is unused by its CNA.26dCVE-2020-8414——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none26dCVE-2025-58165——
——0Rejected reason: This CVE is a duplicate of another CVE, CVE-2025-58163.3dCVE-2023-1015——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.26dCVE-2026-10150——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.27dCVE-2019-18764——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none26dCVE-2017-4368——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none26dCVE-2018-4789——
——0Rejected reason: This candidate is unused by its CNA.26dCVE-2024-9171——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.3dCVE-2026-65629—0.0%
——0Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack.
When jose exports a password-encrypted private key with jose_jwk:to_der/2 (JOSE.JWK.to_der/2), the jose_jwk_der:to_binary/3 function in src/jwk/jose_jwk_der.erl serializes the key as a PKCS#8 EncryptedPrivateKeyInfo using the PBES2 scheme with hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with an iteration count of 2048 and an 8-byte (64-bit) random salt. Neither value can be overridden by the caller.
Both values are far below current guidance (OWASP recommends on the order of 600,000 iterations for PBKDF2-HMAC-SHA256, and NIST recommends salts of at least 128 bits), so the key-stretching work factor is roughly 300 times lower than intended and the short salt reduces the cost of precomputation across keys. The symmetric encryption (AES-256-CBC with a 16-byte random IV) is not affected; the weakness is entirely in the derivation strength. An attacker who obtains one of these exported blobs (for example from a backup, configuration repository, object storage, or logs) can mount a cheap offline dictionary or brute-force attack against the export password, and success yields the full private key.
This issue affects jose: from 1.10.0 before 1.11.13.10dCVE-2025-32772——
——0Rejected reason: Not used26dCVE-2018-4538——
——0Rejected reason: This candidate is unused by its CNA.26dCVE-2024-23417——
——0Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.4dCVE-2025-34732——
——0Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.24dCVE-2017-4067——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none26dCVE-2018-4685——
——0Rejected reason: This candidate is unused by its CNA.26dCVE-2010-0061——
——0Rejected reason: This candidate is unused by its CNA.26dCVE-2020-11393——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none26dCVE-2024-56506——
——0Rejected reason: Not used26dCVE-2025-34567——
——0Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.5dCVE-2025-38611——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.28dCVE-2023-52830——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.28dCVE-2025-53610——
——0Rejected reason: Not used26dCVE-2019-18717——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none26dCVE-2025-65066——
——0Rejected reason: Not used26dCVE-2013-5265——
——0Rejected reason: This candidate is unused by its CNA.26dCVE-2020-12948——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none26dCVE-2025-12152——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.5dCVE-2016-5820——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none26dCVE-2016-7688——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none26dCVE-2017-4401——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none26dCVE-2026-29517——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.28dCVE-2025-58420——
——0Rejected reason: Not used26dCVE-2016-9506——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none26dCVE-2025-53164——
——0Rejected reason: Not used26dCVE-2018-4694——
——0Rejected reason: This candidate is unused by its CNA.26dCVE-2025-63700——
——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.3dCVE-2026-56118——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.28dCVE-2016-7336——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none26dCVE-2024-27421——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.28d