CVE WATCH / VULNERABILITY DETAIL
CVE-2026-102946
CRITICALCVSS 9.1NVD feed
Published 15 October 2026 · tracked since 16 October 2026
Description
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-111138 MEDIUM 5.5
- CVE-2026-110874 MEDIUM 6.6
- CVE-2026-110878 MEDIUM 5.4
- CVE-2026-109924 MEDIUM 5.9
- CVE-2026-109932 MEDIUM 5.9
- CVE-2026-109829 HIGH 7.4
- CVE-2026-109841 MEDIUM 5.9
- CVE-2026-109869 HIGH 7.5
- CVE-2026-109383 HIGH 7.4
- CVE-2026-104150