PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
CVE-2026-102266
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
#msrc
共收录 2151 条相关情报。
← 返回所有主题PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
CVE-2026-102274
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
CVE-2026-102275
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
CVE-2026-102265
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
PyJWT accepts public JWK containers as HMAC secrets
CVE-2026-102273
PyJWT accepts public JWK containers as HMAC secrets
PyJWT BOM Bypass
CVE-2026-102272
PyJWT BOM Bypass
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
CVE-2026-102271 · CVE-2022-29217
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
CVE-2026-101918
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / veri
roxmltree through 0.21.1 Denial of Service via Quadratic Parsing
CVE-2026-92987
roxmltree through 0.21.1 Denial of Service via Quadratic Parsing
(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange
CVE-2026-93304
(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange
Failed X509_verify_cert leaves unverified CA in shared CertManager
CVE-2026-89135
Failed X509_verify_cert leaves unverified CA in shared CertManager
OCSP stapling v2 multi accepts non-CA chain certificates as issuers
CVE-2026-89102
OCSP stapling v2 multi accepts non-CA chain certificates as issuers
Client accepts unsolicited RawPublicKey server certificate type
CVE-2026-89136
Client accepts unsolicited RawPublicKey server certificate type
NameConstraints not enforced across unconstrained intermediate CA
CVE-2026-89133
NameConstraints not enforced across unconstrained intermediate CA
Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion
CVE-2026-42784
Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion
Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow
CVE-2026-88832
Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.
CVE-2026-103111
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-
Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer
CVE-2026-6669
Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer
Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler
CVE-2026-61674
Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler
alsa-lib through 1.2.16.1 Denial of Service via pcm_multi
CVE-2026-96675
alsa-lib through 1.2.16.1 Denial of Service via pcm_multi