Vulnerabilities
Summary — last 7 days
New vulnerabilities5,204▲ 2,196 vs. last week
Critical / high2,861▲ 1,372 vs. last week
New active exploitation (KEV)9▲ 3 vs. last week
Unscored (no CVSS)180▼ 26 vs. last week
2 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Awaiting Analysis | Medium (6.8) | 0.31% | — | Fastify JWTAI | 10/8/2026 | 10/8/2026 | @fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding whitespace, is silently… | |
| Analyzed | High (8.1) | 0.26% | — | Fastify/jwt | 8/15/2026 | 9/4/2026 | @fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different… |