Low
CVE-2025-14505
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 17
Reset filters
Critical
CVE-2025-9287
cipher-base is missing type checks, leading to hash rewind and passing on crafted data
Critical
ghsa-vjh7-7g9h-fjfh
Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)
High
CVE-2024-48930
secp256k1-node allows private key extraction over ECDH
Low
CVE-2024-48948
Valid ECDSA signatures erroneously rejected in Elliptic
Low
CVE-2024-48949
Elliptic's verify function omits uniqueness validation
Low
CVE-2024-42461
Elliptic allows BER-encoded signatures
Low
CVE-2024-42460
Elliptic's ECDSA missing check for whether leading bit of r and s is zero
Low
CVE-2024-42459
Elliptic's EDDSA missing signature length check
High
CVE-2023-25653
Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)
High
CVE-2022-23539
jsonwebtoken unrestricted key type could lead to legacy keys usage
High
CVE-2020-1026
Incorrect Calculation in the MSR JavaScript Cryptography Library
Medium
CVE-2020-28498
Elliptic Uses a Broken or Risky Cryptographic Algorithm
High
CVE-2020-13822
Signature Malleabillity in elliptic
Medium
CVE-2019-9155
Invalid Curve Attack in openpgp
Critical
CVE-2018-8319
Sensitive Data Exposure in msrcrypto
Medium
CVE-2017-16007
Invalid Curve Attack in node-jose
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.