1171 matches found
CVE-2026-103001
creationtimestamp| type| source ---|---|--- 2026-09-08 20:06:01+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q 2026-10-01 03:30:31+00:00| seen| https://gist.github.com/alon710/ae5f872dc1573f4f9211b4ab5e48215f 2026-10-05 14:39:10+00:00|...
NewStart CGSL MAIN 7.02 : python-PyJWT Multiple Vulnerabilities (NS-SA-2026-0091)
The remote NewStart CGSL host, running version MAIN 7.02, has python-PyJWT packages installed that are affected by multiple vulnerabilities: - PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 4.1.11...
PT-2026-103622
Name of the Vulnerable Software and Affected Versions PyJWT versions 2.11.0 through 2.13.0 Description The PyJWT. merge options function can modify a mutable options mapping provided by the caller when verify signature is set to false. If an application reuses this modified mapping in subsequent...
PT-2026-102366
Name of the Vulnerable Software and Affected Versions PyJWT versions 2.9.0 through 2.13.x Description PyJWT fails to handle a ValueError triggered by the RSAAlgorithm.from jwk function in jwt/api jwk.py when processing malformed RSA JSON Web Key JWK components. If a JWK Set contains a single...
CVE-2026-55165
Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...
CVE-2026-55165 Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure
Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...
Security Bulletin: Vulnerabilities found in Watson Data Intelligence
Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.4.0 Patch4 Vulnerability Details CVEID:CVE-2026-48522 DESCRIPTION: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen whic...
CLSA-2026-1787038724 TuxCare security update for pyjwt (3 CVEs)
TuxCare rebuilt pyjwt to address 3 CVEs. Fixed in 1.7.1.post3+tuxcare...
CLSA-2026-1787028607 TuxCare security update for pyjwt (1 CVE)
TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 2.3.0.post3+tuxcare...
PT-2026-83040
TuxCare rebuilt pyjwt to address 3 CVEs. Fixed in 1.7.1.post3+tuxcare...
PT-2026-83029
TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 2.3.0.post3+tuxcare...
Amazon Linux 2023 : python3-jwt, python3-jwt+crypto (ALAS2023-2026-2051)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2051 advisory. PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector...
CLSA-2026-1786944250 TuxCare security update for pyjwt (2 CVEs)
TuxCare rebuilt pyjwt to address 2 CVEs. Fixed in 2.8.0.post3+tuxcare...
PT-2026-82438
TuxCare rebuilt pyjwt to address 2 CVEs. Fixed in 2.8.0.post3+tuxcare...
CLSA-2026-1786522025 TuxCare security update for pyjwt (1 CVE)
TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 2.10.1.post3+tuxcare...
CLSA-2026-1786521955 TuxCare security update for pyjwt (2 CVEs)
TuxCare rebuilt pyjwt to address 2 CVEs. Fixed in 2.3.0.post2+tuxcare...
CLSA-2026-1786520090 TuxCare security update for pyjwt (1 CVE)
TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 2.8.0.post2+tuxcare...
PT-2026-80101
TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 2.10.1.post3+tuxcare...