Security advisories

medium2026-09-29

CVE-2026-102265-PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

View chart →

jpadilla/pyjwt · GHSA-8wjv-2p76-3863

medium2026-09-29

CVE-2026-102269-PyJWT: Non-canonical signature segments enable raw-token revocation bypass

View chart →

jpadilla/pyjwt · GHSA-hxm8-2xgr-2p9m

critical2026-09-29

CVE-2026-102268-PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

View chart →

jpadilla/pyjwt · GHSA-ffc3-869f-jxw9

high2026-09-29

CVE-2026-102273-PyJWT accepts public JWK containers as HMAC secrets

View chart →

jpadilla/pyjwt · GHSA-w2cx-738m-mc7w

high2026-09-29

CVE-2026-102267-PyJWT: PyJWKClient follows redirects when fetching JWKS

View chart →

jpadilla/pyjwt · GHSA-9v7f-9g4p-ffgj

high2026-09-29

CVE-2026-102271-PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

View chart →

jpadilla/pyjwt · GHSA-p4g4-x82p-q773

high2026-09-29

CVE-2026-102272-PyJWT BOM Bypass

View chart →

jpadilla/pyjwt · GHSA-r6x4-923q-g947

medium2026-09-29

CVE-2026-101917-PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

View chart →

jpadilla/pyjwt · GHSA-2gx3-rcp4-g85q

medium2026-09-29

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

View chart →

cthackers/adm-zip · GHSA-p634-w6r4-rjp2

medium2026-09-29

adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

View chart →

cthackers/adm-zip · GHSA-c6fg-446q-cg94

high2026-09-29

adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

View chart →

cthackers/adm-zip · GHSA-8238-w5pm-2374

medium2026-09-29

CVE-2026-102342-Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

View chart →

rust-ammonia/ammonia · GHSA-m6mh-2hw2-555x

high2026-09-29

adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

View chart →

cthackers/adm-zip · GHSA-rcw4-f5rp-g42v

high2026-09-29

CVE-2026-102282-adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

View chart →

cthackers/adm-zip · GHSA-j5f4-cc29-5x44

low2026-09-29

CVE-2026-102279-Laravel: XSS in Debug Page Information

View chart →

laravel/framework · GHSA-jh5r-qr3c-85q8

medium2026-09-29

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

View chart →

nodemailer/nodemailer · GHSA-8vvx-rff5-p5rq

medium2026-09-29

CVE-2026-102274-PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

View chart →

jpadilla/pyjwt · GHSA-w6j9-cwv2-h6wq

medium2026-09-29

CVE-2026-18149-undici vulnerable to Denial of Service via orphaned RetryHandler response body

View chart →

nodejs/undici · GHSA-pmjh-fq2x-6v4x

low2026-09-29

CVE-2026-18540-undici vulnerable to downstream response splitting via retry interceptor

View chart →

nodejs/undici · GHSA-r53p-7pc4-xj5r

high2026-09-29

CVE-2026-19534-undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

View chart →

nodejs/undici · GHSA-rfgv-xxqx-mfg5