High
CVE-2026-61442
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 34
Reset filters
Medium
CVE-2026-61440
PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization
Medium
CVE-2026-61441
PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
Medium
CVE-2026-103001
PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse
Medium
CVE-2026-101918
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
Medium
CVE-2026-102269
PyJWT: Non-canonical signature segments enable raw-token revocation bypass
Critical
CVE-2026-102268
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
High
CVE-2026-102272
PyJWT BOM Bypass
Medium
CVE-2026-102265
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
High
CVE-2026-102273
PyJWT accepts public JWK containers as HMAC secrets
Medium
CVE-2026-102274
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
Medium
CVE-2026-101917
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
High
CVE-2026-102266
PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
High
CVE-2026-102267
PyJWT: PyJWKClient follows redirects when fetching JWKS
Medium
CVE-2026-102270
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
High
CVE-2026-102271
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
Medium
CVE-2026-102275
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
Critical
CVE-2026-57147
praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery
Critical
CVE-2026-57148
praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)
High
CVE-2026-49852
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
Medium
CVE-2026-55165
Lemur: JWT verifier honors attacker-supplied alg, enabling ATO
Medium
CVE-2026-55837
dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
High
CVE-2026-30762
LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass
Low
CVE-2024-53861
PyJWT Issuer field partial matches allowed
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.