OpenIDC cjose

• CVE-2026-53939 Critical 9.1 OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption 0.2%
• CVE-2026-53938 High 8.2 OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW) 0.2%
• CVE-2023-37464 High 8.6 Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose 0.7%