brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

CVE-2026-102276

### Summary `parseCommaParts()` can exhaust the native stack and crash the process. There are two distinct ways to trig

历史摘要 · 未重新核验 · GitHub Advisory

Socket.IO: Engine.IO Protocol Revision Mismatch DoS

CVE-2026-102599

### Impact A denial-of-service vulnerability exists in Engine.IO / Socket.IO servers that allow transport upgrades. Th

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

## Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service

### Summary When `addressparser` finds no address by its strict reading, it falls back to pulling one out of the free t

历史摘要 · 未重新核验 · GitHub Advisory

PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

CVE-2026-102266

### Summary A service that verifies HS256 tokens using an empty oct JWK through PyJWK, including a PyJWK obtained from

历史摘要 · 未重新核验 · GitHub Advisory

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

CVE-2026-102265

## Package pyjwt (PyPI) ## Affected versions tested & verified on: 2.13.0. Every version whose `PyJWS._load()` transl

历史摘要 · 未重新核验 · GitHub Advisory

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

CVE-2026-102269

## Summary PyJWT 2.13.0 accepts compact JWS signature segments containing characters that are not in the Base64URL alph

历史摘要 · 未重新核验 · GitHub Advisory

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

CVE-2026-102268

**Prerequisites** (both conditions must hold; both are deployment properties, not attacker-controlled at request time):

历史摘要 · 未重新核验 · GitHub Advisory

PyJWT accepts public JWK containers as HMAC secrets

CVE-2026-102273

### Summary PyJWT 2.13.0 contains an incomplete defense against algorithm confusion when an application mixes symmetric

历史摘要 · 未重新核验 · GitHub Advisory

PyJWT: PyJWKClient follows redirects when fetching JWKS

CVE-2026-102267

### Summary PyJWT 2.13.0 `PyJWKClient` followed HTTP redirects while fetching a JWKS, without validating the redirect d

历史摘要 · 未重新核验 · GitHub Advisory

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

CVE-2026-102271

### Summary `HMACAlgorithm.prepare_key` blocks asymmetric keys from being used as HMAC secrets by searching for text ma

历史摘要 · 未重新核验 · GitHub Advisory

PyJWT BOM Bypass

CVE-2026-102272

## Affected Package - **Package**: PyJWT (`pyjwt` on PyPI) - **Repository**: https://www.google.com/url?q=https://githu

历史摘要 · 未重新核验 · GitHub Advisory

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

CVE-2026-101917

Summary CVE-2026-48524 (GHSA-fhv5-28vv-h8m8, "PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid v

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

### Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list,

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

### Summary adm-zip enforces a `maxOutputLength` guard against decompression bombs on its synchronous `getData()` path,

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

## Summary Denial of Service in `adm-zip`'s async decompression API allows an unauthenticated attacker to crash the ent

历史摘要 · 未重新核验 · GitHub Advisory

Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-102342

The following SVG will produce a link with a `javascript` scheme. If the user clicks this link, they will run it. ```sv

历史摘要 · 未重新核验 · GitHub Advisory

Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()

CVE-2026-61519

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending tea

历史摘要 · 未重新核验 · OSV.dev

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

CVE-2026-102831

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

历史摘要 · 未重新核验 · OSV.dev

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

CVE-2026-102830

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

历史摘要 · 未重新核验 · OSV.dev