The device's update mechanism includes conditions that allow unauthorized software packages to be...
CVE-2026-91191
The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic.
#cwe-347
共收录 355 条相关情报。
← 返回所有主题PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
CVE-2026-102266
### Summary A service that verifies HS256 tokens using an empty oct JWK through PyJWK, including a PyJWK obtained from
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
CVE-2026-102268
**Prerequisites** (both conditions must hold; both are deployment properties, not attacker-controlled at request time):
PyJWT accepts public JWK containers as HMAC secrets
CVE-2026-102273
### Summary PyJWT 2.13.0 contains an incomplete defense against algorithm confusion when an application mixes symmetric
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
CVE-2026-102271
### Summary `HMACAlgorithm.prepare_key` blocks asymmetric keys from being used as HMAC secrets by searching for text ma
PyJWT BOM Bypass
CVE-2026-102272
## Affected Package - **Package**: PyJWT (`pyjwt` on PyPI) - **Repository**: https://www.google.com/url?q=https://githu
The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disable...
CVE-2026-91191
The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic.
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic h...
CVE-2026-100293
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware withou
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-le...
CVE-2026-102273
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does ...
CVE-2026-102272
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt
PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual...
CVE-2026-102271
PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key i
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM repre...
CVE-2026-102268
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key w...
CVE-2026-102266
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affect
Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check...
CVE-2026-94418
Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse t
Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to keep peak memory down, then merges the two results, but...
CVE-2026-94418
Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse t
Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY
CVE-2026-94418
Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse t
Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the...
CVE-2025-71422
Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume fe
Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a craft...
CVE-2025-71422
Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume fe
MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears...
CVE-2026-97731
MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied
social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing
CVE-2026-57178
### Impact The `vk-app` backend accepted VK application callback data without verifying the callback signature when the