https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T13:26:01.280576+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-glances-cve-2024-33663 BREW-glances-CVE-2024-33663 — python-jose algorithm confusion with OpenSSH ECDSA keys 2026-10-03T13:26:01.382695+00:00

Affected: Homebrew: glances

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

 https://cve.radiocsirt.org/vuln/euvd-2026-367871 EUVD-2026-367871 2026-10-03T13:26:01.382760+00:00 EUVD-2026-367871 https://cve.radiocsirt.org/vuln/fkie_cve-2026-85394 fkie_cve-2026-85394 2026-10-03T13:26:01.382778+00:00

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.

 https://cve.radiocsirt.org/vuln/ghsa-3qf3-8w2g-rqmx GHSA-3qf3-8w2g-rqmx 2026-10-03T13:26:01.382805+00:00

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-85394 UBUNTU-CVE-2026-85394 2026-10-03T13:26:01.382822+00:00

Affected: Ubuntu:22.04:LTS: python-jose, Ubuntu:24.04:LTS: python-jose

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.