agentprime: eclipse-foundation-eclipse-keypont-goseEvery new CVE for eclipse-foundation-eclipse-keypont-gose.https://agentprime.io/CVE-2026-89320: HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrityhttps://agentprime.io/advisories/CVE-2026-89320/https://agentprime.io/advisories/CVE-2026-89320/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 08:56:20 GMTCVECVE-2026-89319: JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocationhttps://agentprime.io/advisories/CVE-2026-89319/https://agentprime.io/advisories/CVE-2026-89319/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 08:54:37 GMTCVECVE-2026-89318: JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)https://agentprime.io/advisories/CVE-2026-89318/https://agentprime.io/advisories/CVE-2026-89318/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 08:51:55 GMTCVECVE-2026-89317: JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)https://agentprime.io/advisories/CVE-2026-89317/https://agentprime.io/advisories/CVE-2026-89317/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 08:50:22 GMTCVECVE-2026-89316: LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertionhttps://agentprime.io/advisories/CVE-2026-89316/https://agentprime.io/advisories/CVE-2026-89316/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 08:48:08 GMTCVECVE-2026-89315: JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffixhttps://agentprime.io/advisories/CVE-2026-89315/https://agentprime.io/advisories/CVE-2026-89315/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 08:46:30 GMTCVECVE-2026-89314: Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 shttps://agentprime.io/advisories/CVE-2026-89314/https://agentprime.io/advisories/CVE-2026-89314/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 08:43:38 GMTCVECVE-2026-89313: JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nilhttps://agentprime.io/advisories/CVE-2026-89313/https://agentprime.io/advisories/CVE-2026-89313/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 08:40:55 GMTCVECVE-2026-89312: AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IVhttps://agentprime.io/advisories/CVE-2026-89312/https://agentprime.io/advisories/CVE-2026-89312/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 08:36:53 GMTCVE