Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

54 matches found

osv_oesa
osv_oesa•added 2026/10/16 12:00 p.m.•11 views

OESA-2026-4386 python-jwt security update

setup.py test %endif Security Fixes: PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an...

9.1CVSS7.3AI score0.00236EPSS
SaveExploits3References4
osv_oesa
osv_oesa•added 2026/10/16 12:00 p.m.•9 views

OESA-2026-4384 python-jwt security update

setup.py test %endif Security Fixes: PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an...

9.1CVSS7.3AI score0.00236EPSS
SaveExploits3References4
osv_oesa
osv_oesa•added 2026/10/16 12:00 p.m.•9 views

OESA-2026-4385 python-jwt security update

setup.py test %endif Security Fixes: PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an...

9.1CVSS7.3AI score0.00236EPSS
SaveExploits3References4
NVD
NVD•added 2026/10/07 3:16 a.m.•24 views

CVE-2026-16516

wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...

9CVSS0.00191EPSS
SaveExploits0References2
Mend
Mend•added 2026/10/07 2:38 a.m.•11 views

CVE-2026-16516

wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...

9.3CVSS5.9AI score0.00191EPSS
SaveExploits0References3
CVE
CVE•added 2026/10/07 2:38 a.m.•37 views

CVE-2026-16516

The wolfSSH library contains a vulnerability in the ParseECCPubKey() function (located in src/internal.c) where it fails to validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the negotiated algorithm during the key exchange. Specifically, the software uses the blob's ...

9CVSS5.9AI score0.00191EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist•added 2026/09/30 4:09 p.m.•47 views

CVE-2026-103442 MergeAccount PHP object injection via session-key substitution

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43...

8.7CVSS0.0028EPSS
SaveExploits1References2
SUSE CVE
SUSE CVE•added 2026/09/29 11:39 p.m.•16 views

SUSE CVE-2026-102267

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

7.4CVSS5.9AI score0.00159EPSS
SaveExploits0References7
osv_debian
osv_debian•added 2026/09/28 9:17 p.m.•14 views

DEBIAN-CVE-2026-102267

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

9.1CVSS5.9AI score0.00159EPSS
SaveExploits0References1
osv_azl
osv_azl•added 2026/09/28 9:17 p.m.•16 views

AZL-104979 CVE-2026-102267 affecting package python-jwt 2.13.0-1

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

9.1CVSS5.9AI score0.00159EPSS
SaveExploits0References1
NVD
NVD•added 2026/09/28 9:17 p.m.•49 views

CVE-2026-102267

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

9.1CVSS0.00159EPSS
SaveExploits0References3
UbuntuCve
UbuntuCve•added 2026/09/28 9:17 p.m.•14 views

CVE-2026-102267

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

9.1CVSS5.9AI score0.00159EPSS
SaveExploits0References6
osv_ubuntu
osv_ubuntu•added 2026/09/28 9:17 p.m.•14 views

UBUNTU-CVE-2026-102267

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

9.1CVSS5.9AI score0.00159EPSS
SaveExploits0References7
Cvelist
Cvelist•added 2026/09/28 8:23 p.m.•50 views

CVE-2026-102267 PyJWT: PyJWKClient follows redirects when fetching JWKS

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

7.4CVSS0.00159EPSS
SaveExploits0References3
CVE
CVE•added 2026/09/28 8:23 p.m.•119 views

CVE-2026-102267

The PyJWT library (versions prior to 2.14.0 ) is vulnerable in the PyJWKClient component because it fails to revalidate redirect destinations against the JWKS trust boundary . An attacker who can influence a configured trusted JWKS endpoint's response can trigger a redirect, causing PyJWKClient t...

9.1CVSS5.9AI score0.00159EPSS
SaveExploits0References3Affected Software1
EUVD
EUVD•added 2026/09/28 8:23 p.m.•25 views

EUVD-2026-88534

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

7.4CVSS6AI score0.00159EPSS
SaveExploits0References3
osv_cve
osv_cve•added 2026/09/28 8:23 p.m.•20 views

CVE-2026-102267 PyJWT: PyJWKClient follows redirects when fetching JWKS

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

7.4CVSS5.9AI score0.00159EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment•added 2026/09/28 8:23 p.m.•8 views

CVE-2026-102267 PyJWT: PyJWKClient follows redirects when fetching JWKS

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

7.4CVSS5.9AI score0.00159EPSS
SaveExploits0References3
Mend
Mend•added 2026/09/28 8:23 p.m.•15 views

CVE-2026-102267

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

9.1CVSS5.9AI score0.00159EPSS
SaveExploits0References8
Debian CVE
Debian CVE•added 2026/09/28 8:23 p.m.•21 views

CVE-2026-102267

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

9.1CVSS5.9AI score0.00159EPSS
SaveExploits0
Rows per page
Query Builder