CVE-2026-102268

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, ispemformat in jwt/utils.py is affected because ispemformat does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and...

Signal-iOS v8.27.0.1843

Signal iOS Signal is a free and open source messaging app for simple private communication with friends. Also available on Android and Desktop. Questions? For troubleshooting and questions, please visit our support center or unofficial community forum. Contributing Bug Reports The best way to...

CVE-2026-22818

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly defi...

CVE-2026-22818 JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly defi...

PT-2026-2799

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.11.4 Description Hono’s JWT verification middleware had a flaw where the algorithm specified in the JWT header could influence signature verification, even when the selected JWK did not explicitly define an algorithm...