PyJWT versions from 2.4.0 up to but not including 2.14.0 contain a vulnerability in the HMACAlgorithm.prepare_key function. This flaw arises when applications mix HMAC and asymmetric algorithms and provide a DER-encoded public key as the shared verification key. Due to improper verification of cryptographic signatures, PyJWT mistakenly uses the public DER bytes as an HMAC secret. An attacker with knowledge of the public key can exploit this to forge authenticated HMAC tokens. The vulnerability is fixed in version 2.14.0.
A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component TGA Image Handler. Executing a manipulation can lead to out-of-bounds write. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
PyJWT versions from 2.1.0 up to but not including 2.15.0 contain a vulnerability in the OKPAlgorithm.from_jwk function where the private JWK import does not verify that the public key component x corresponds to the private key component d. This can lead to a mismatch between the identity derived from x and operations performed with d. If an integration accepts private key parameters from a proof header without rejecting them, an attacker could misuse a stolen sender-constrained token without possessing the legitimate private key. The issue is fixed in version 2.15.0.
PyJWT versions from 2.13.0 up to but not including 2.14.0 contain a vulnerability where deeply nested JSON arrays in the JWT header cause a RecursionError during parsing. This error is not caught by the library's usual exception handling, resulting in an HTTP 500 server error and a full traceback logged. This allows unauthenticated attackers to cause a denial of service on JWT validation endpoints without crashing the server or exposing data. The issue is fixed in PyJWT 2.14.0.
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.
CVE-2026-102278 is a high-severity vulnerability in the juliangruber brace-expansion library. It involves uncontrolled recursion in the expand_() function when processing deeply nested brace groups, which can exhaust the native stack and cause the Node.js process to terminate. This leads to a denial of service condition. The issue affects multiple versions prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, where the recursion occurs at comma-member and single-set expansion sites. The vulnerability is fixed in these versions.
Keio Corporation, a major Japanese railway and hospitality operator, suffered a ransomware attack that disrupted some business systems, primarily affecting its hospitality operations. The attack was confirmed on September 26, 2026, and led to a network shutdown to prevent further damage. The company is investigating the extent of the impact and whether any customer or partner data was accessed. The ransomware incident impacted payment systems and caused delays in customer-facing services at Keio Plaza Hotel Tokyo. There is no public claim of responsibility by any ransomware group at this time. A separate cyber incident was reported by Tokyo Metro, but no confirmed link between the two events exists.
CVE-2026-102277 is a medium severity vulnerability in the juliangruber brace-expansion library that causes uncontrolled resource consumption. The expand function in affected versions repeatedly rescans input patterns with many trailing closing braces, leading to quadratic CPU and memory usage. This results in a recoverable denial of service by blocking the Node.js event loop. The issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.
CVE-2026-102270 is a Regular Expression Denial of Service (ReDoS) vulnerability in the pyjwt library's is_pem_format function. The vulnerability arises from a regex pattern that exhibits quadratic time complexity when processing malformed PEM-like inputs consisting of repeated '-----BEGIN CERTIFICATE-----' lines without a corresponding '---- END' line. This can cause excessive CPU usage, potentially leading to resource exhaustion and denial of service. The issue affects pyjwt versions prior to 2.14.0. A fix replacing the vulnerable regex with a bounded marker scan was released in pyjwt 2.14.0 on 2026-09-11.
PyJWT versions prior to 2.14.0 accept JWS signature segments with non-canonical Base64URL characters, which do not affect the decoded signature or claims but alter the serialized token and its hash. This can allow bypass of logout or revocation mechanisms that rely on the raw serialized token as a security identity. The issue is not related to signature forgery and requires possession of a valid token. A fix rejecting such non-canonical characters is prepared but not yet released.
PyJWT versions prior to 2.14.0 contain a vulnerability in the is_pem_format function that improperly verifies cryptographic signatures. This flaw allows an attacker who knows a public key to forge authenticated HMAC tokens by exploiting how the library misinterprets certain malformed PEM public keys as HMAC secrets. The issue is resolved in version 2.14.0.
PyJWT versions prior to 2.14.0 contain a vulnerability in the PyJWKClient component where HTTP redirects during JWKS fetching are followed without validating the redirect destination. This can lead to exposure of sensitive request headers and allow an attacker-influenced redirect to poison JWKS trust, potentially causing acceptance of forged JWTs. The issue requires an attacker to influence the configured JWKS endpoint's response and is not triggered by token key IDs alone. The vulnerability is fixed in PyJWT 2.14.0.
PyJWT versions 2.9.0 through 2.13.0 contain a vulnerability where a malformed RSA JWK in a JWK Set causes the entire set parsing to abort due to an uncaught ValueError. This happens because the ValueError raised by the cryptography library during RSA key recovery is not caught by PyJWT's exception handling, leading to denial of service in key processing.
PyJWT versions from 2.13.0 up to but not including 2.14.0 contain a vulnerability in the HMACAlgorithm.prepare_key function. The issue arises because the HMAC key guard only recognizes top-level public JWK forms and misses container representations, allowing public asymmetric key material to be accepted as the HMAC secret. This flaw enables an attacker who knows the public key to forge tokens with arbitrary authenticated claims. The vulnerability is fixed in version 2.14.0.
PyJWT version 2.13.0 has a vulnerability in its cryptographic signature verification due to improper handling of UTF-8 BOM prefixes in JSON Web Key detection. This flaw allows attackers who know the RSA public key to forge JWT tokens with arbitrary claims if the verifier accepts both HS256 and RS256 algorithms. The issue causes an RSA public key to be misinterpreted as an HMAC secret, resulting in complete authentication and authorization bypass. A fix has been committed but not yet released as of the advisory date.
CVE-2026-101187 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. It affects the USB Device Management API function pop_usb_device in the file usr/lib/lua/luci/controller/api/zrUsb.lua. The vulnerability allows remote attackers to execute arbitrary commands by manipulating the argument path. Public exploit code is available, and the vendor has not responded to disclosure. No patch or remediation guidance is currently provided.
CVE-2026-91096 is a use-after-free vulnerability in Facebook's proxygen library affecting versions from 2024.10.28.00 up to but not including 2026.09.28.00. The issue arises because the WebTransportImpl component fails to unregister read callbacks for streams that are no longer open before destroying them, potentially allowing the transport to invoke a freed read callback. This vulnerability has a high severity rating with a CVSS score of 7.5, indicating a significant impact on confidentiality without affecting integrity or availability.
CVE-2026-91095 is a use-after-free vulnerability in Facebook's proxygen library affecting versions from 2024.10.28.00 up to but not including 2026.09.28.00. The issue arises when certain HTTPTransaction APIs return stream handles that have already been freed, leading to potential use of freed memory. This flaw could cause application instability or crashes but does not impact confidentiality or integrity.
CVE-2026-84895 is a use-after-free vulnerability in Facebook's proxygen library affecting versions from 2026.04.06.00 up to but not including 2026.09.28.00. The issue occurs when QuicWtSession::closeSession accesses member fields after the base class method QuicWtSessionBase::closeSession potentially destroys the session object. This can lead to memory corruption and impacts confidentiality, integrity, and availability.