https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 03:57:58 +0000 https://cve.radiocsirt.org/vuln/brew-azure-cli-cve-2025-45768 <p><strong>Affected:</strong> Homebrew: azure-cli</p> <p>pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).</p> <p><strong>Affected:</strong> Homebrew: azure-cli</p> <p>pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).</p> https://cve.radiocsirt.org/vuln/brew-azure-cli-cve-2025-45768 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0756 certfr-2025-avi-0756 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0756 https://cve.radiocsirt.org/vuln/euvd-2026-249830 EUVD-2026-249830 https://cve.radiocsirt.org/vuln/euvd-2026-249830 https://cve.radiocsirt.org/vuln/fkie_cve-2025-45768 <p>pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).</p> <p>pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-45768 https://cve.radiocsirt.org/vuln/ghsa-xpf8-484v-j9w6 <p>pyjwt v2.10.1 was discovered to contain weak encryption.</p> <p>pyjwt v2.10.1 was discovered to contain weak encryption.</p> https://cve.radiocsirt.org/vuln/ghsa-xpf8-484v-j9w6 https://cve.radiocsirt.org/vuln/msrc_cve-2025-45768 msrc_CVE-2025-45768 https://cve.radiocsirt.org/vuln/msrc_cve-2025-45768 https://cve.radiocsirt.org/vuln/pysec-2025-183 <p><strong>Affected:</strong> PyPI: pyjwt</p> <p>pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).</p> <p><strong>Affected:</strong> PyPI: pyjwt</p> <p>pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).</p> https://cve.radiocsirt.org/vuln/pysec-2025-183 https://cve.radiocsirt.org/vuln/rhsa-2026:33154 <p>pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools tar-fs: link following and path traversal via maliciously crafted tar file nanoid: nanoid mishandles non-integer values brace-expansion: juliangruber brace-expansion index.js expand redos lodash: prototype pollution in _.unset and _.omit functions golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation ceph: privilege escalation by unprivileged users in a ceph-fuse mounted CephFS tar-fs: tar-fs symlink validation bypass urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)</p> <p>pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools tar-fs: link following and path traversal via maliciously crafted tar file nanoid: nanoid mishandles non-integer values brace-expansion: juliangruber brace-expansion index.js expand redos lodash: prototype pollution in _.unset and _.omit functions golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation ceph: privilege escalation by unprivileged users in a ceph-fuse mounted CephFS tar-fs: tar-fs symlink validation bypass urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)</p> https://cve.radiocsirt.org/vuln/rhsa-2026:33154 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-45768 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: pyjwt, Ubuntu:18.04:LTS: pyjwt, Ubuntu:20.04:LTS: pyjwt, Ubuntu:22.04:LTS: pyjwt, Ubuntu:24.04:LTS: pyjwt, Ubuntu:25.10: pyjwt, Ubuntu:25.04: pyjwt</p> <p>pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: pyjwt, Ubuntu:18.04:LTS: pyjwt, Ubuntu:20.04:LTS: pyjwt, Ubuntu:22.04:LTS: pyjwt, Ubuntu:24.04:LTS: pyjwt, Ubuntu:25.10: pyjwt, Ubuntu:25.04: pyjwt</p> <p>pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-45768 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2424 <p>Ein Angreifer kann mehrere Schwachstellen in IBM Rational Team Concert ausnutzen, um einen Denial-of-Service-Angriff durchzuführen, Eingaben oder Protokolle zu manipulieren, die Authentifizierung zu umgehen, beliebigen Code auszuführen, Cross-Site-Scripting durchzuführen, sensible Informationen offenzulegen oder offene Weiterleitungen auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM Rational Team Concert ausnutzen, um einen Denial-of-Service-Angriff durchzuführen, Eingaben oder Protokolle zu manipulieren, die Authentifizierung zu umgehen, beliebigen Code auszuführen, Cross-Site-Scripting durchzuführen, sensible Informationen offenzulegen oder offene Weiterleitungen auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2424