[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-84185":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":27,"aliases":28,"duplicate_of":9,"upstream":31,"downstream":32,"duplicates":37,"related":38,"reserved_at":9,"published_at":41,"modified_at":42,"state":43,"summary":44,"references_raw":53,"kevs":82,"epss":83,"epss_history":86,"metrics":129,"affected":141},"CVE-2026-84185","A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-347","Improper Verification of Cryptographic Signature","The product does not verify, or incorrectly verifies, the cryptographic signature for data.","weakness","Draft","Base",[19,23],{"id":20,"name":21,"techniques":22},"CAPEC-463","Padding Oracle Crypto Attack",[],{"id":24,"name":25,"techniques":26},"CAPEC-475","Signature Spoofing by Improper Validation",[],[],[29,30],"UBUNTU-CVE-2026-84185","DEBIAN-CVE-2026-84185",[],[33,35],{"_key":34},"OPENSUSE-SU-2026:11712-1",{"_key":36},"OPENSUSE-SU-2026:21827-1",[],[39,40],{"_key":34},{"_key":36},"2026-09-03T20:46:40.788Z","2026-09-04T18:57:22.299Z","Awaiting Analysis",{"cisa_kev":45,"cisa_ransomware":45,"cisa_vendor":9,"epss_severity":46,"epss_score":47,"severity":48,"severity_score":49,"severity_version":50,"severity_source":51,"severity_vector":52,"severity_status":43},false,"low",0.00087,"medium",5.9,"v3.1","cve.org","CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",[54,63,68,72,76],{"url":55,"sources":56,"tags":59},"https://access.redhat.com/security/cve/CVE-2026-84185",[51,57,58],"nvd","osv_ubuntu",[60,61,62],"VDB Entry","X Refsource REDHAT","REPORT",{"url":64,"sources":65,"tags":66},"https://bugzilla.redhat.com/show_bug.cgi?id=2526729",[51,57,58],[67,61,62],"Issue Tracking",{"url":69,"sources":70,"tags":71},"https://ubuntu.com/security/CVE-2026-84185",[58],[62],{"url":73,"sources":74,"tags":75},"https://www.cve.org/CVERecord?id=CVE-2026-84185",[58],[62],{"url":77,"sources":78,"tags":80},"https://security-tracker.debian.org/tracker/CVE-2026-84185",[79],"osv_debian",[81],"Advisory",[],{"date":84,"score":47,"percentile":85},"2026-09-19",0.00415,[87,90,93,96,98,100,103,106,109,112,115,117,120,123,126,128],{"date":88,"score":47,"percentile":89},"2026-09-04",0.00393,{"date":91,"score":47,"percentile":92},"2026-09-05",0.00388,{"date":94,"score":47,"percentile":95},"2026-09-06",0.00387,{"date":97,"score":47,"percentile":95},"2026-09-07",{"date":99,"score":47,"percentile":95},"2026-09-08",{"date":101,"score":47,"percentile":102},"2026-09-09",0.00389,{"date":104,"score":47,"percentile":105},"2026-09-10",0.00391,{"date":107,"score":47,"percentile":108},"2026-09-11",0.00401,{"date":110,"score":47,"percentile":111},"2026-09-12",0.004,{"date":113,"score":47,"percentile":114},"2026-09-13",0.00399,{"date":116,"score":47,"percentile":114},"2026-09-14",{"date":118,"score":47,"percentile":119},"2026-09-15",0.00398,{"date":121,"score":47,"percentile":122},"2026-09-16",0.00409,{"date":124,"score":47,"percentile":125},"2026-09-17",0.00416,{"date":127,"score":47,"percentile":125},"2026-09-18",{"date":84,"score":47,"percentile":85},[130,135,137,139],{"source":51,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":131,"cvss_v4_0":9},{"baseScore":49,"baseSeverity":132,"vectorString":52,"impactScore":133,"exploitabilityScore":134},"MEDIUM",7,4.1,{"source":57,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":136,"cvss_v4_0":9},{"baseScore":49,"baseSeverity":132,"vectorString":52,"impactScore":133,"exploitabilityScore":134},{"source":58,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":138,"cvss_v4_0":9},{"baseScore":49,"baseSeverity":9,"vectorString":52,"impactScore":133,"exploitabilityScore":134},{"source":79,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":140,"cvss_v4_0":9},{"baseScore":49,"baseSeverity":9,"vectorString":52,"impactScore":133,"exploitabilityScore":134},[142,154],{"ecosystem":143,"name":144,"vendor":145,"product":144,"cpe_part":9,"purl_type":146,"purl_namespace":145,"purl_name":144,"source":9,"versions":147},"Debian","python-jwcrypto","debian","deb",[148,152,153],{"version":149,"is_range":150,"range_type":151,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"version":149,"is_range":150,"range_type":151,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":149,"is_range":150,"range_type":151,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":155,"name":144,"vendor":156,"product":144,"cpe_part":9,"purl_type":146,"purl_namespace":156,"purl_name":144,"source":9,"versions":157},"Ubuntu","ubuntu",[158,159,160,161,162,163],{"version":149,"is_range":150,"range_type":151,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":149,"is_range":150,"range_type":151,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":149,"is_range":150,"range_type":151,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":149,"is_range":150,"range_type":151,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":149,"is_range":150,"range_type":151,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":149,"is_range":150,"range_type":151,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9}]