PT-2026-102655

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A CMP client that requests certificate revocation using a PKCS10 CSR may experience a NULL pointer dereference when processing a specially crafted revocation response from a server. This occu...

CVE-2026-102269

A flaw was found in PyJWT. When decoding JSON Web Token JWT signature segments, the library accepts characters outside the standard Base64URL encoding format. A remote attacker can exploit this issue by appending extra characters to a valid token signature, creating an alternate token...

DEBIAN-CVE-2026-102269

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

AZL-104985 CVE-2026-102269 affecting package python-jwt 2.13.0-1

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

CVE-2026-102269

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

CVE-2026-102269

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

UBUNTU-CVE-2026-102269

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

CVE-2026-102269 PyJWT: Non-canonical signature segments enable raw-token revocation bypass

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

CVE-2026-102269 PyJWT: Non-canonical signature segments enable raw-token revocation bypass

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

CVE-2026-102269

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

EUVD-2026-88536

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

CVE-2026-102269

The PyJWT Python library (prior to version 2.14.0 ) is vulnerable to a signature segment decoding issue. The library incorrectly accepts characters outside the canonical Base64URL representation, allowing non-Base64URL characters to be appended to a valid compact JWS signature segment. Because ba...

CVE-2026-102269 PyJWT: Non-canonical signature segments enable raw-token revocation bypass

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

GO-2026-6482 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server

Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server...

K000163436: Apache Tomcat vulnerabilities CVE-2026-73581, CVE-2026-76183, CVE-2026-77762, and CVE-2026-79677

Security Advisory Description CVE-2026-73581 Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M...

CVE-2026-73581

A flaw was found in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM Transport Layer Security TLS implementations fail to properly check Certificate Revocation Lists CRLs when a certificate uses a keystore. This oversight could allow an attacker to use a revoked certificate, potentially leading to...

RLSA-2026:25341 Important: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

RockyLinux 10 : tomcat9 (RLSA-2026:25341)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:25341 advisory. tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 tomcat: Client certificate verification...

CVE-2026-102269: Incorrect Behavior Order: Validate Before Canonicalize

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

CVE-2026-94417

When an application enables both OCSP and CRL revocation checking on one WOLFSSLCTX or certificate manager, wolfSSL skips the CRL check for any peer certificate that carries no Authority Information Access OCSP URL, and accepts a certificate the loaded CRL lists as revoked. The soft-fail policy f...