aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...

1xn-vmcp (>=0.1.0, <=0.6.1), a2 (>=0.1.0, <=0.8.3) +2059 more potentially affected by CVE-2026-85394 via python-jose (>=3.0.0, <=3.5.0)

python-jose PYPI version =3.0.0, =0.1.0, =0.1.0, =0.3.6, =0.1.0a1, =0.1.2b0, =0.0.1a1, =0.1.0, =0.1.1, =3.1.0b1, =0.0.3, =1.0.0, =1.0.3, =0.1.0a0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-85394 Source advisory: GHSA-3QF3-8W2G-RQMX...

python-jose algorithm confusion guard bypassed by DER-encoded public keys

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

datawire-cloudtools (0.2.6) potentially affected by CVE-2024-33663 +1 more via python-jose (0.5.5)

python-jose PYPI version 0.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on python-jose and may be impacted: - datawire-cloudtools 0.2.6 Source cves: CVE-2024-33663, CVE-2026-85394 Source advisory: OSV:GHSA-3QF3-8W2G-RQMX...

allennlp (>=0.8.0, <=0.8.2), cloudless (0.0.0) +6 more potentially affected by CVE-2024-33663 +1 more via python-jose (2.0.2)

python-jose PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on python-jose and may be impacted: - allennlp =0.8.0, =1.0.0, =1.3.4, =0.4.3, =0.0.25, =0.0.26 Source cves: CVE-2024-33663, CVE-2026-85394 Source advisory:...

1xn-vmcp (>=0.1.0, <=0.6.1), a2 (>=0.1.0, <=0.8.3) +2059 more potentially affected by CVE-2024-33663 +1 more via python-jose (>=3.0.0, <=3.5.0)

python-jose PYPI version =3.0.0, =0.1.0, =0.1.0, =0.3.6, =0.1.0a1, =0.1.2b0, =0.0.1a1, =0.1.0, =0.1.1, =3.1.0b1, =0.0.3, =1.0.0, =1.0.3, =0.1.0a0, =1.0.0, =1.1.0 and more Source cves: CVE-2024-33663, CVE-2026-85394 Source advisory: OSV:GHSA-3QF3-8W2G-RQMX...

flask-adfs (>=0.1.9, <=0.1.19), ghoauth (>=0.5.1, <=0.6.1) +1 more potentially affected by CVE-2024-33663 +1 more via python-jose (1.3.2)

python-jose PYPI version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on python-jose and may be impacted: - flask-adfs =0.1.9, =0.5.1, =0.3.2, =0.3.3 Source cves: CVE-2024-33663, CVE-2026-85394 Source advisory: OSV:GHSA-3QF3-8W2G-RQMX...

core-devoops (>=0.0.1, <=0.0.2) potentially affected by CVE-2024-33663 +1 more via python-jose (1.4.0)

python-jose PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-jose and may be impacted: - core-devoops =0.0.1, =0.0.2 Source cves: CVE-2024-33663, CVE-2026-85394 Source advisory: OSV:GHSA-3QF3-8W2G-RQMX...

GHSA-3QF3-8W2G-RQMX python-jose algorithm confusion guard bypassed by DER-encoded public keys

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the HMAC secret guard of jose/backends/native.py, which rejects a key only when ispemformatkey or issshkeykey holds and so never catches DER-encoded binary SubjectPublicKeyInfo public...

NeuroSploit

🧠 NeuroSploit v4.0.0...

CVE-2026-85394

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

AZL-99750 CVE-2026-85393 affecting package python-tensorboard 2.16.2-6

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an...

CVE-2026-85394

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

UBUNTU-CVE-2026-85394

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

EUVD-2026-70671

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

CVE-2026-85394

python-jose through version 3.5.0 contains an algorithm confusion vulnerability in its HMAC key validation logic. The library fails to properly reject DER-encoded public keys that lack PEM armor or SSH prefixes, allowing them to be accepted as HMAC secrets. An attacker who possesses the service's...

CVE-2026-85394 python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

CVE-2026-85394

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...