High
ghsa-8w8g-wq8h-fq33
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,787
Reset filters
High
ghsa-5fqc-mrg8-w798
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
High
ghsa-cm62-gvxx-vmxx
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
High
CVE-2026-102998
pypdf: Possible long runtimes when generating appearance streams
High
CVE-2026-102997
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)
High
CVE-2026-102999
pypdf: Possible long runtimes with large amount of embedded files
High
CVE-2026-103000
pypdf: Possible large memory usage when retrieving alphabetical page labels
Medium
CVE-2026-97688
urllib3: Chunked Deflate streaming can enter an infinite loop
High
CVE-2026-97689
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
High
CVE-2026-102996
pypdf: Possible large memory usage when parsing font data
Medium
CVE-2026-103001
PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse
Medium
CVE-2026-101918
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
High
CVE-2026-102993
pypdf: Possible large memory usage when retrieving Roman page labels
High
CVE-2026-102994
pypdf: Possible long runtimes/large memory usage when parsing indirect objects
High
CVE-2026-102995
pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)
Medium
CVE-2026-84377
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
High
CVE-2026-97687
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
Medium
CVE-2026-102269
PyJWT: Non-canonical signature segments enable raw-token revocation bypass
Critical
CVE-2026-102268
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
High
CVE-2026-102272
PyJWT BOM Bypass
Medium
CVE-2026-102265
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
High
CVE-2026-102273
PyJWT accepts public JWK containers as HMAC secrets
Medium
CVE-2026-102274
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
Medium
CVE-2026-101917
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.