Jpadilla vulnerabilities, page 2

22 vulnerabilities

Known vulnerabilities in Jpadilla products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.

6.5CVE-2026-103001chainguardauthentik-fips-2026.5+14
EPSS score
0.24%
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected.7.5CVE-2026-32597chainguardairflow-2+80
EPSS score
0.27%
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.