1083 matches found
DEBIAN-CVE-2026-75509
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...
UBUNTU-CVE-2026-75509
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...
CVE-2026-75509
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...
CVE-2026-75509 joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...
EUVD-2026-65138
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...
CVE-2026-75509 joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...
CVE-2026-75509
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...
JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens
A flaw was found in JWCrypto, a Python library for JSON Web Key JWK, JSON Web Signature JWS, and JSON Web Encryption JWE specifications. An unauthenticated attacker can exploit this vulnerability by sending specially crafted JWE tokens that use ZIP compression. While the input token size is...
RLSA-2026:58562 Important: python-urwid security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
CLSA-2026-1787551351 TuxCare security update for django (11 CVEs)
TuxCare rebuilt django to address 11 CVEs. Fixed in 5.1.post5+tuxcare...
[SECURITY] Fedora 43 Update: GitPython-3.1.59-1.fc43
GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...
OPENSUSE-SU-2026:11585-1 python313-mistune-3.3.4-1.1 on GA media
These are all security issues fixed in the python313-mistune-3.3.4-1.1 package on the GA media of openSUSE Tumbleweed...
GitPython Arbitrary Command Execution
The vulnerability of the checkunsafeoptions mechanism in the Python library for interacting with Git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...
GitPython IndexFile Methods File Rewrite
The vulnerabilities of the IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods in the GitPython library for interacting with git repositories involve the exploitation of arguments. Exploiting these vulnerabilities can allow an attacker to rewrite any files at will...
ALSA-2026:58561 Important: python-urwid security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
GHSA-892M-GCQ8-2468 Duplicate Advisory: Uncontrolled recursion DoS in JustHTML() via deeply nested HTML
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v7cf-c9rm-wm3j. This link is maintained to preserve external references. Original Description justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During...
PYSEC-2026-3729
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...
PYSEC-2026-3730
NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...
PYSEC-2026-3722
NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only activ...
PYSEC-2026-3722
NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only activ...