pyjwt project kayıtları
pyjwt project üreticisine ait 24 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 0
- Düzeltme kaydı olan
- %100
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-347 Improper Verification of Cryptographic Signature6
- CWE-345 Insufficient Verification of Data Authenticity2
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor1
- CWE-287 Improper Authentication1
- CWE-311 Missing Encryption of Sensitive Data1
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm1
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
24 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
36İzleyin | CVE-2026-102268Kavram kanıtı | PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardpyjwt project · pyjwt · CWE-347 | Kritik9,1 | — | %0,2 | 28 Eyl 2026 |
36İzleyin | CVE-2026-102266İstismar yok | PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validationpyjwt project · pyjwt · CWE-347 | Kritik9,1 | — | %0,2 | 28 Eyl 2026 |
36İzleyin | CVE-2026-102267İstismar yok | PyJWT: PyJWKClient follows redirects when fetching JWKSpyjwt project · pyjwt · CWE-200 | Kritik9,1 | — | %0,2 | 28 Eyl 2026 |
32İzleyin | CVE-2026-102275İstismar yok | PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionpyjwt project · pyjwt · CWE-345 | Yüksek8,2 | — | %0,1 | 28 Eyl 2026 |
31İzleyin | CVE-2017-11424İstismar yok | In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys.pyjwt project · pyjwt | Yüksek7,5 | — | %1,8 | 24 Ağu 2017 |
30İzleyin | CVE-2022-29217İstismar yok | Key confusion through non-blocklisted public key formats in PyJWTpyjwt project · pyjwt · CWE-327 | Yüksek7,5 | — | %1,4 | 24 May 2022 |
30İzleyin | CVE-2024-53861İstismar yok | Issuer field partial matches allowed in pyjwtpyjwt project · pyjwt · CWE-697 | Yüksek7,5 | — | %0,8 | 29 Kas 2024 |
30İzleyin | CVE-2026-101917İstismar yok | PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)pyjwt project · pyjwt · CWE-770 | Yüksek7,5 | — | %0,4 | 28 Eyl 2026 |
30İzleyin | CVE-2026-102274İstismar yok | PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Setpyjwt project · pyjwt · CWE-755 | Yüksek7,5 | — | %0,4 | 28 Eyl 2026 |
30İzleyin | CVE-2026-101918İstismar yok | PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)pyjwt project · pyjwt · CWE-248 | Yüksek7,5 | — | %0,4 | 28 Eyl 2026 |
30İzleyin | CVE-2026-32597İstismar yok | PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)pyjwt project · pyjwt · CWE-345 | Yüksek7,5 | — | %0,3 | 13 Mar 2026 |
29İzleyin | CVE-2026-48526İstismar yok | PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowedpyjwt project · pyjwt · CWE-287 | Yüksek7,4 | — | %0,4 | 28 May 2026 |
29İzleyin | CVE-2026-102272İstismar yok | PyJWT is a Python implementation of JSON Web Token standards.pyjwt project · pyjwt · CWE-347 | Yüksek7,4 | — | %0,2 | 28 Eyl 2026 |
29İzleyin | CVE-2026-102271İstismar yok | PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guardpyjwt project · pyjwt · CWE-347 | Yüksek7,4 | — | %0,2 | 28 Eyl 2026 |
29İzleyin | CVE-2026-102273İstismar yok | PyJWT accepts public JWK containers as HMAC secretspyjwt project · pyjwt · CWE-347 | Yüksek7,4 | — | %0,2 | 28 Eyl 2026 |
28İzleyin | CVE-2025-45768İstismar yok | pyjwt v2.10.1 was discovered to contain weak encryption.pyjwt project · pyjwt · CWE-311 | Yüksek7,0 | — | %0,2 | 31 Tem 2025 |
26İzleyin | CVE-2026-103001İstismar yok | PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reusepyjwt project · pyjwt · CWE-471 | Orta6,5 | — | %0,2 | 30 Eyl 2026 |
21İzleyin | CVE-2026-48525İstismar yok | PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWSpyjwt project · pyjwt · CWE-400 | Orta5,3 | — | %0,4 | 28 May 2026 |
21İzleyin | CVE-2026-102265İstismar yok | PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token headerpyjwt project · pyjwt · CWE-674 | Orta5,3 | — | %0,3 | 28 Eyl 2026 |
21İzleyin | CVE-2026-102269İstismar yok | PyJWT: Non-canonical signature segments enable raw-token revocation bypasspyjwt project · pyjwt · CWE-180 | Orta5,4 | — | %0,2 | 28 Eyl 2026 |
21İzleyin | CVE-2026-48523İstismar yok | PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keyspyjwt project · pyjwt · CWE-347 | Orta5,4 | — | %0,2 | 28 May 2026 |
19İzleyin | CVE-2026-102270İstismar yok | PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.pyjwt project · pyjwt · CWE-1333 | Orta4,9 | — | %0,2 | 28 Eyl 2026 |
16İzleyin | CVE-2026-48522İstismar yok | PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemespyjwt project · pyjwt · CWE-441 | Orta4,2 | — | %0,2 | 28 May 2026 |
14İzleyin | CVE-2026-48524İstismar yok | PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)pyjwt project · pyjwt · CWE-460 | Düşük3,7 | — | %0,3 | 28 May 2026 |
- CVE-2026-10226836İzleyin
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
KritikCVSS 9,1Kavram kanıtıEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10226636İzleyin
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
KritikCVSS 9,1İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10226736İzleyin
PyJWT: PyJWKClient follows redirects when fetching JWKS
KritikCVSS 9,1İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10227532İzleyin
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
YüksekCVSS 8,2İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2017-1142431İzleyin
In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys.
YüksekCVSS 7,5İstismar yokEPSS %2pyjwt project · pyjwt24 Ağu 2017
- CVE-2022-2921730İzleyin
Key confusion through non-blocklisted public key formats in PyJWT
YüksekCVSS 7,5İstismar yokEPSS %1pyjwt project · pyjwt24 May 2022
- CVE-2024-5386130İzleyin
Issuer field partial matches allowed in pyjwt
YüksekCVSS 7,5İstismar yokEPSS %1pyjwt project · pyjwt29 Kas 2024
- CVE-2026-10191730İzleyin
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
YüksekCVSS 7,5İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10227430İzleyin
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
YüksekCVSS 7,5İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10191830İzleyin
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
YüksekCVSS 7,5İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-3259730İzleyin
PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
YüksekCVSS 7,5İstismar yokEPSS %0pyjwt project · pyjwt13 Mar 2026
- CVE-2026-4852629İzleyin
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
YüksekCVSS 7,4İstismar yokEPSS %0pyjwt project · pyjwt28 May 2026
- CVE-2026-10227229İzleyin
PyJWT is a Python implementation of JSON Web Token standards.
YüksekCVSS 7,4İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10227129İzleyin
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
YüksekCVSS 7,4İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10227329İzleyin
PyJWT accepts public JWK containers as HMAC secrets
YüksekCVSS 7,4İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2025-4576828İzleyin
pyjwt v2.10.1 was discovered to contain weak encryption.
YüksekCVSS 7,0İstismar yokEPSS %0pyjwt project · pyjwt31 Tem 2025
- CVE-2026-10300126İzleyin
PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse
OrtaCVSS 6,5İstismar yokEPSS %0pyjwt project · pyjwt30 Eyl 2026
- CVE-2026-4852521İzleyin
PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS
OrtaCVSS 5,3İstismar yokEPSS %0pyjwt project · pyjwt28 May 2026
- CVE-2026-10226521İzleyin
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
OrtaCVSS 5,3İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10226921İzleyin
PyJWT: Non-canonical signature segments enable raw-token revocation bypass
OrtaCVSS 5,4İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-4852321İzleyin
PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys
OrtaCVSS 5,4İstismar yokEPSS %0pyjwt project · pyjwt28 May 2026
- CVE-2026-10227019İzleyin
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
OrtaCVSS 4,9İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-4852216İzleyin
PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes
OrtaCVSS 4,2İstismar yokEPSS %0pyjwt project · pyjwt28 May 2026
- CVE-2026-4852414İzleyin
PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
DüşükCVSS 3,7İstismar yokEPSS %0pyjwt project · pyjwt28 May 2026