Product by Ubuntu
Pyjwt
15 known vulnerabilities in Pyjwt (Ubuntu), 0 of them actively exploited (CISA KEV).
Key figures
15
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-102268 | Jpadilla Pyjwt: Improper Verification of Cryptographic Signature | 9.1 | |
| High | CVE-2026-102274 | PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set | 5.9 | |
| High | CVE-2026-102272 | PyJWT BOM Bypass | 7.4 | |
| Critical | CVE-2026-102266 | PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation | 7.4 | |
| High | CVE-2026-102271 | PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard | 7.4 | |
| High | CVE-2026-102273 | PyJWT accepts public JWK containers as HMAC secrets | 7.4 | |
| Critical | CVE-2026-102267 | PyJWT: PyJWKClient follows redirects when fetching JWKS | 7.4 | |
| High | CVE-2026-101917 | Jpadilla Pyjwt: Allocation of Resources Without Limits or Throttling | 5.3 | |
| High | CVE-2026-48526 | Jpadilla Pyjwt: Improper Verification of Cryptographic Signature | 7.4 | |
| High | CVE-2026-101918 | Jpadilla Pyjwt: Uncaught Exception | 5.3 | |
| High | CVE-2026-102275 | PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion | 6.5 | |
| Medium | CVE-2026-48525 | Jpadilla Pyjwt: Uncontrolled Resource Consumption | 5.3 | |
| Low | CVE-2026-48524 | PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) | 3.7 | |
| Medium | CVE-2026-48523 | PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys | 5.4 | |
| Medium | CVE-2026-48522 | Jpadilla Pyjwt: Server-Side Request Forgery (SSRF) | 4.2 |