Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) by vulnerability in github.com/slackhq/nebula package

Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark by vulnerability in github.com/slackhq/nebula package. IBM optim 1.2.0 resolves this vulnerability by upgrading the package from vulnerable version Vulnerability Details CVEID:CVE-2026-25793 DESCRIPTION: Nebula is a scalable overlay networking...

Astra Linux – Vulnerability in Node-Elliptic

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed...

smart-contract-security-training

Smart Contract Security Training Hands-on smart contract secu...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses joserfc-1.6.4-py3-none-any.whl, HdrHistogram-2.2.2.jar, and logback-core-1.5.32.jar which are vulnerable to CVE-2026-62995, CVE-2026-14683, CVE-2026-14684, CVE-2026-10532, and CVE-2026-9828. This bulletin contains information regarding the vulnerability and its fix...

Security Bulletin: Multiple vulnerabilities in IBM MQ Agent images

Summary Multiple vulnerabilities were addressed in IBM MQ Agent images Vulnerability Details CVEID:CVE-2026-62995 DESCRIPTION: joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWT...

Canonicalization Failures As a Recurring Vulnerability Class: Representation Divergence in Cryptographic Systems and Its Avoidance

Cryptographic systems operate on bytes but mean semantic objects. The translation between the two is rarely unique. Where this uniqueness is not enforced, an attack surface opens up as soon as a hash, a signature, replay protection, or consensus identity depends on the representation. The same...

OPENSUSE-SU-2026:21515-1 Security update for python-joserfc

This update for python-joserfc fixes the following issues: Changes in python-joserfc: - CVE-2026-62995: acceptance of JWTs with trailing padding can lead to JWT malleability and allows for bypass of token revocation and anti-replay protection bsc1272991...

SUSE CVE-2026-62995

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-62995

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-62995

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-62995

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

EUVD-2026-50450

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-62995 joserfc accepts JWT with padding, leading to JWT malleability

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-62995

CVE-2026-62995 affects the Python library joserfc (versions ≤ 1.7.1). The issue: joserfc accepts JWTs with trailing padding (==), which is non-conforming to JOSE specs and enables JWT malleability when parsed by the library. Practical impact varies by deployment and could allow bypass of token re...

CVE-2026-62995 joserfc accepts JWT with padding, leading to JWT malleability

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-62995 joserfc accepts JWT with padding, leading to JWT malleability

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

Dependency on Vulnerable Third-Party Component

Overview matrix-nio is an A Python Matrix client library, designed according to sans I/O principles. Affected versions of this package are vulnerable to Dependency on Vulnerable Third-Party Component due to the use of a deprecated cryptographic dependency, which introduces multiple cryptographic...

CVE-2026-62995: Insufficient Verification of Data Authenticity

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

PT-2026-65869

Name of the Vulnerable Software and Affected Versions joserfc versions prior to 1.7.2 Description The library accepts JSON Web Tokens JWTs containing trailing padding ==, which does not conform to JSON Object Signing and Encryption JOSE specifications. This results in token malleability, where a...

Linux Distros Unpatched Vulnerability : CVE-2026-62995

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc...