TI-2026-65301 CVE-2026-102266 · GHSA-9j54-fg26-wv3r
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
Priority HIGH 74
PyJWT is a Python implementation of JSON Web Token standards.
RHSA-2026:87004
Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
Released 2026-10-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-gateway-server-2.6.20261019-1.el9ap, automation-platform-ui-2.6.15-1.el9ap, python3.12-pulpcore-3.49.71-1.el9ap +2
Fixes 10 records
TI-2026-65307 CVE-2026-102272 · GHSA-r6x4-923q-g947
PyJWT BOM Bypass
Priority HIGH 68
PyJWT is a Python implementation of JSON Web Token standards.
TI-2026-65306 CVE-2026-102271 · GHSA-p4g4-x82p-q773
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
Priority HIGH 68
PyJWT is a Python implementation of JSON Web Token standards.
TI-2026-61668 CVE-2026-90711 · GHSA-jqcg-44mw-7w3h
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
Priority MEDIUM 41
proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips.
TI-2026-65302 CVE-2026-102267 · GHSA-9v7f-9g4p-ffgj
PyJWT: PyJWKClient follows redirects when fetching JWKS
Priority MEDIUM 40
PyJWT is a Python implementation of JSON Web Token standards.
TI-2026-59907 CVE-2026-87776 · GHSA-vc2v-76pw-4v95
compression vulnerable to Denial of Service via memory leak on premature response close
Priority LOW 39
compression is a Node.js and Express compression middleware.
TI-2026-61819 CVE-2026-90959 · GHSA-mfxv-9hc5-3jv3
Path traversal in Red Hat Ansible Automation Platform 2.6 for RHEL 9
Priority LOW 37
A path traversal vulnerability was found in pulpcore.
TI-2026-33552 CVE-2026-45820 · GHSA-px8p-9vwx-vf98
Uncontrolled resource consumption in 101arrowz fflate
Priority LOW 35
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync().
TI-2026-65308 CVE-2026-102273 · GHSA-w2cx-738m-mc7w
PyJWT accepts public JWK containers as HMAC secrets
Priority LOW 34
PyJWT is a Python implementation of JSON Web Token standards.
TI-2026-63427 CVE-2026-94416 · GHSA-ch6h-xwwm-655w
Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery
Priority LOW 31
An authorization bypass was found in the Ansible Automation Platform (AAP) gateway.