https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T20:50:02.653770+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0523 certfr-2026-avi-0523 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-05T20:50:02.657229+00:00 certfr-2026-avi-0523 https://cve.radiocsirt.org/vuln/euvd-2026-160118 EUVD-2026-160118 2026-10-05T20:50:02.657263+00:00 EUVD-2026-160118 https://cve.radiocsirt.org/vuln/fkie_cve-2024-31033 fkie_cve-2024-31033 2026-10-05T20:50:02.657278+00:00

JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.

 https://cve.radiocsirt.org/vuln/ghsa-r65j-6h5f-4f92 Withdrawn: GHSA-r65j-6h5f-4f92 — Withdrawn: JJWT improperly generates signing keys 2026-10-05T20:50:02.657309+00:00

Withdrawn by the publisher.

Affected: Maven: io.jsonwebtoken:jjwt-impl

## Withdrawn Advisory

This advisory has been withdrawn because it has been found to be disputed. Please see the issue [here](https://github.com/jwtk/jjwt/issues/930#issuecomment-2032699358) for more information.

## Original Description

JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class.

 https://cve.radiocsirt.org/vuln/gsd-2024-31033 gsd-2024-31033 2026-10-05T20:50:02.657337+00:00 gsd-2024-31033 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1273 WID-SEC-W-2024-1273 — IBM Business Automation Workflow: Schwachstelle ermöglicht nicht spezifizierten Angriff 2026-10-05T20:50:02.657350+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM Business Automation Workflow ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.