CVE-2026-102266 is a vulnerability in PyJWT 2.13.0 where verification of HS256 tokens using an empty symmetric octet JWK key bypasses the intended empty key rejection. While raw empty HMAC keys are rejected, empty keys supplied via PyJWK objects are accepted, allowing attackers to forge valid HS256 JWTs if the application uses an empty key in its JWK set. This occurs because the PyJWK verification path does not invoke the empty key validation, enabling signature verification with a zero-length key.
setup.py test %endif
Security Fix(es):
PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.(CVE-2026-101918)
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.(CVE-2026-102265)
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.(CVE-2026-102269)
PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.(CVE-2026-102275)
setup.py test %endif
Security Fix(es):
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.(CVE-2026-101917)
PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.(CVE-2026-101918)
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.(CVE-2026-102265)
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.(CVE-2026-102269)
PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.(CVE-2026-102275)
Times Car, a Japanese car-sharing service, confirmed a data breach affecting approximately 6.6 million current and former user accounts. The breach involved unauthorized access to personal information including names, addresses, dates of birth, contact details, driver’s license data, identity verification documents, account passwords (stored in a non-reversible form), and linked service IDs. Credit card information was not compromised. The company blocked access shortly after discovery and is conducting a forensic investigation with external experts. Notifications to affected users are being sent in stages. There is currently no evidence that the stolen data has been distributed online.
CVE-2026-101146 is an information disclosure vulnerability in Eleveo Quality Management version 9.7.0. The flaw exists in the UtilsService.createAndSaveAudit function within the GWT RPC Handler component. This vulnerability can be exploited remotely without user interaction and allows attackers to obtain sensitive information. The vendor has not responded to the disclosure, and no patch or remediation is currently available. The vulnerability has a medium severity rating with a CVSS score of 5.3. Public exploit code has been released, increasing the risk of exploitation.
CVE-2026-102005 is a medium severity memory leak vulnerability in Wind River VxWorks 7 versions 24.03 through 26.03. The issue occurs under specific, non-default configuration states when processing certain service routines, causing the system to terminate operations without releasing allocated memory pools. This vulnerability was fixed in version 26.09.
DOMSanitizer versions prior to 1.0.15 have an input validation flaw in the isDangerousUrl() method. The sanitizer rejects 'javascript:' URLs but only partially rejects 'data:' URLs by checking for the literal substring 'onload'. Because data: payloads are often Base64-encoded, dangerous content can bypass this check and remain in href or xlink:href attributes. This incomplete sanitization could allow active markup to persist. The issue is fixed in version 1.0.15.
CVE-2026-101916 is a high-severity vulnerability in grpc-node's @grpc/grpc-js library where improper certificate validation occurs. Versions prior to 1.13.6 and between 1.14.0 and before 1.14.5 do not properly distinguish authorized from unauthorized peer certificates when server credentials have requireClientCertificate set to false. This can cause applications to mistakenly treat unauthorized certificates as authorized, leading to improper authentication. The issue also affects @grpc/grpc-js-xds when RBAC authentication is enabled. The vulnerability is fixed in versions 1.13.6 and 1.14.5.
CVE-2026-18416 is a low-severity vulnerability in the Zephyr project affecting the CoAP server subsystem. It involves an out-of-bounds read in the match_path_uri() function when processing URI queries in CoAP /.well-known/core requests. The flaw causes reading past the end of a URI option value buffer, leading to undefined behavior but no information disclosure or matching errors. The issue affects Zephyr versions from 1.8.0 up to but not including 4.4.2.
CVE-2026-18415 is a medium severity vulnerability in the Zephyr project affecting versions from 3.2.0 up to but not including 4.4.2. It involves an out-of-bounds write in the ieee802154_send() function when sending packets through NET_AF_PACKET sockets bound to an 802.15.4 interface. The vulnerability arises because length validation is skipped in certain socket types, allowing an application to cause a buffer overrun past a fixed 125-byte transmit buffer. This can lead to memory corruption, crashes, or kernel state compromise. The issue is not reachable via normal radio packet transmission paths. A fix is available that adds proper length validation and prevents buffer overruns.
CVE-2026-18414 is a high-severity vulnerability in the Zephyr project's ADC driver for the ADI MAX32 device. The driver incorrectly validates the buffer size for ADC sampling sequences, allowing a buffer overrun by writing more data than the buffer can hold. This can lead to kernel memory corruption, potentially enabling privilege escalation or denial of service from an unprivileged user-mode thread. The issue affects Zephyr versions from 4.0.0 up to but not including 4.4.2. A fix has been implemented by replacing the faulty buffer size check with a proper validation helper that accounts for sample size.
CVE-2026-18413 is a vulnerability in the Zephyr project affecting the NXP MCUX LPADC driver. The driver fails to check if the destination buffer is large enough before writing ADC samples, allowing out-of-bounds writes. This can lead to kernel memory corruption when unprivileged user-mode threads control the ADC device with CONFIG_USERSPACE enabled. The issue enables potential privilege escalation and denial-of-service. A fix has been implemented to validate buffer sizes before sampling.
CVE-2026-16513 is a high-severity memory-safety vulnerability in the Zephyr RTOS affecting versions from 3.4.0 up to but not including 4.4.2. It involves an unchecked write through a user-supplied pointer in the RTIO syscall verifier, allowing a user-mode thread with RTIO kernel object access to perform a write-what-where operation in kernel memory. This can lead to kernel memory corruption, crashes, or privilege escalation from user mode to kernel mode. The issue only affects builds with CONFIG_USERSPACE and CONFIG_RTIO enabled. A fix has been implemented to add proper memory write checks on the output parameter to prevent this vulnerability.
The ConvertPlus WordPress plugin up to version 3.6.3 contains a vulnerability involving deserialization of untrusted data via an AJAX action parameter. This flaw allows authenticated users with Subscriber-level access or higher to inject a PHP object if a gadget chain is available in other installed plugins or themes. The vulnerability arises from insufficient nonce validation, lack of capability checks, and improper sanitization that permits shortcode injection leading to unsafe unserialization. Exploitation depends on the presence of a POP chain in additional installed components. The vulnerability has a high severity rating with a CVSS score of 8.8.
Dutch police have confirmed the arrest of a 24-year-old man in Amsterdam linked to an investigation of the ShinyHunters hacking group. The arrest is part of law enforcement efforts to disrupt this threat actor's activities.
A vulnerability in grpc-node prior to versions 1.13.6 and 1.14.5 causes server-generated error messages to include sensitive information. When an application method handler throws an uncaught error, the server sends the error message back to the client, potentially exposing sensitive data. This issue has a low severity score and is fixed in versions 1.13.6 and 1.14.5.
CVE-2026-102004 is a high-severity vulnerability in Wind River VxWorks 7 prior to version 26.09. It involves an out-of-bounds write caused by specific system call arguments leading to memory corruption in the memory management subsystem. This flaw can result in confidentiality, integrity, and availability impacts. The issue has been fixed in version 26.09.
A vulnerability in grpc-node versions prior to 1.13.1 and between 1.14.0 and 1.14.1 causes the RBAC path matcher to perform a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. This can lead to incorrect authorization if one method name prefixes another and they have different access rules. The issue is fixed in versions 1.13.1 and 1.14.1.
LiteLLM in BerriAI has a weak authentication vulnerability that allows attackers with a valid JWT to impersonate any user by exploiting an email-based fallback lookup that does not verify the email_verified claim. This flaw enables attackers to inherit victim roles, including administrative privileges, and persistently overwrite identity bindings to maintain unauthorized access to sensitive endpoints.
CVE-2026-101141 is a medium severity cross-site scripting (XSS) vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw exists in the /callrec/audio.jsp file within the Play Audio Page component, where manipulation of the viewRoleId or cfType arguments can lead to XSS. The vulnerability can be exploited remotely and requires low privileges with partial user interaction. The vendor has not responded to the disclosure, and no patch or remediation is currently confirmed.