# Weak cryptography or TLS.

Weak algorithms, randomness, signatures or certificate checks. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first

- [Improper signature verification in Chainguard MinIO](https://agentprime.io/advisories/CVE-2026-122267.md)
  `CVE-2026-122267` · CVE record: Chainguard MinIO · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS
- [Incorrect validation of TLS certificates in the MatchPoint Android app](https://agentprime.io/advisories/CVE-2026-111494.md)
  `CVE-2026-111494` · CVE record: TPC Software Matchpoint · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS
- [FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY](https://agentprime.io/advisories/CVE-2026-116790.md)
  `CVE-2026-116790` · CVE record: signalwire freeswitch · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [FreeSWITCH: DTLS-SRTP peer certificate is not bound to the SDP fingerprint when FreeSWITCH is the DTLS server](https://agentprime.io/advisories/CVE-2026-116789.md)
  `CVE-2026-116789` · CVE record: signalwire freeswitch · CVSS 7.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS, CWE-300
- [Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates](https://agentprime.io/advisories/CVE-2026-96453.md)
  `CVE-2026-96453` · CVE record: Red Hat Red Hat AMQ Broker 7 and 4 more · CVSS 8.0 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS
- [Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer](https://agentprime.io/advisories/CVE-2026-93998.md)
  `CVE-2026-93998` · CVE record: Red Hat Red Hat AMQ Broker 7 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS
- [ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download](https://agentprime.io/advisories/CVE-2026-61813.md)
  `CVE-2026-61813` · CVE record: owasp-modsecurity ModSecurity · CVSS 3.7 Low · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS
- [Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names](https://agentprime.io/advisories/CVE-2026-117691.md)
  `CVE-2026-117691` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS
- [vault-java-driver: SslConfig silently disables requested TLS verification](https://agentprime.io/advisories/CVE-2026-109408.md)
  `CVE-2026-109408` · CVE record: jopenlibs vault-java-driver · CVSS 7.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS, CWE-636
- [Improper certificate validation in Samsung Semiconductor Exynos 1080 and others](https://agentprime.io/advisories/CVE-2026-33965.md)
  `CVE-2026-33965` · CVE record: Samsung Semiconductor Exynos 1080 and 4 more · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS
- [Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates](https://agentprime.io/advisories/CVE-2026-122318.md)
  `CVE-2026-122318` · CVE record: kyverno kyverno · CVSS 7.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS
- [VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security Config](https://agentprime.io/advisories/CVE-2026-54373.md)
  `CVE-2026-54373` · CVE record: Shenzhen Shine Industrial Co., Ltd. VitaFit · CVSS 5.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Weak cryptography or TLS
- [VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation](https://agentprime.io/advisories/CVE-2026-54372.md)
  `CVE-2026-54372` · CVE record: Shenzhen Shine Industrial Co., Ltd. VitaFit · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Weak cryptography or TLS
- [GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover](https://agentprime.io/advisories/CVE-2026-102894.md)
  `CVE-2026-102894` · CVE record: gpustack gpustack · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Multiple vulnerabilities that affects IBM Db2 Genius Hub](https://agentprime.io/advisories/CVE-2026-110281.md)
  `CVE-2026-110281` · CVE record: IBM Db2 Genius Hub · CVSS 5.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Weak cryptography or TLS
- [SumatraPDF: TLS hostname validation disabled in \`HttpGet()\`](https://agentprime.io/advisories/CVE-2026-115758.md)
  `CVE-2026-115758` · CVE record: sumatrapdfreader sumatrapdf · CVSS 8.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: Weak cryptography or TLS
- [WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks](https://agentprime.io/advisories/CVE-2026-121638.md)
  `CVE-2026-121638` · CVE record: WatchGuard AuthPoint Authentication Gateway · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Weak cryptography or TLS
- [Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery](https://agentprime.io/advisories/CVE-2026-121970.md)
  `CVE-2026-121970` · CVE record: wphostingdev Pay with Vipps and MobilePay for WooCommerce · CVSS 6.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Weak cryptography or TLS
- [Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application](https://agentprime.io/advisories/CVE-2026-121147.md)
  `CVE-2026-121147` · CVE record: Tata Motors Tata Motors iRA 2.0 and 1 more · CVSS 8.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: Weak cryptography or TLS
- [Missing GSDX SignatureValue verification](https://agentprime.io/advisories/CVE-2026-110021.md)
  `CVE-2026-110021` · CVE record: Phoenix Contact PLCnext Engineer · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Weak cryptography or TLS
- [sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready](https://agentprime.io/advisories/CVE-2026-87043.md)
  `CVE-2026-87043` · CVE record: zephyrproject zephyr · CVSS 4.8 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Weak cryptography or TLS
- [Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification](https://agentprime.io/advisories/CVE-2026-121606.md)
  `CVE-2026-121606` · CVE record: Qihoo 360 D621-2 and 4 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Weak cryptography or TLS, CWE-345
- [Tanium addressed an improper certificate validation vulnerability in multiple products](https://agentprime.io/advisories/CVE-2026-121565.md)
  `CVE-2026-121565` · CVE record: Tanium TanOS and 4 more · CVSS 7.4 High · Not analysed yet · Published 3 Nov 2026 · Tags: Weak cryptography or TLS
- [Weak encryption in Google Chrome](https://agentprime.io/advisories/CVE-2026-121109.md)
  `CVE-2026-121109` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Weak cryptography or TLS
- [Cleartext transmission of sensitive information in Devolutions Server](https://agentprime.io/advisories/CVE-2026-120734.md)
  `CVE-2026-120734` · CVE record: Devolutions Server · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Weak cryptography or TLS
- [Keycloak has authentication bypass via jwt algorithm confusion](https://agentprime.io/advisories/GHSA-j97h-3f8r-mrjr.md)
  `GHSA-j97h-3f8r-mrjr`, `BIT-keycloak-2026-11800`, `CVE-2026-11800` · Maven `org.keycloak:keycloak-services`: affected `<26.6.4`, fixed in `26.6.4` · CVSS 8.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Weak cryptography or TLS
- [Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation](https://agentprime.io/advisories/CVE-2026-121624.md)
  `CVE-2026-121624` · CVE record: Nanosystems Supremo · CVSS 7.6 High · Not analysed yet · Published 3 Nov 2026 · Tags: Weak cryptography or TLS
- [Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections](https://agentprime.io/advisories/CVE-2026-115714.md)
  `CVE-2026-115714` · CVE record: Elastic Elastic Docker images · CVSS 7.4 High · Not analysed yet · Published 3 Nov 2026 · Tags: Weak cryptography or TLS
- [Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())](https://agentprime.io/advisories/CVE-2026-121553.md)
  `CVE-2026-121553` · CVE record: cotonti cotonti · CVSS 6.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Weak cryptography or TLS
- [bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service](https://agentprime.io/advisories/CVE-2026-121452.md)
  `CVE-2026-121452` · CVE record: mlogclub bbs-go · CVSS 8.3 High · Not analysed yet · Published 3 Nov 2026 · Tags: Weak cryptography or TLS
- [FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate](https://agentprime.io/advisories/CVE-2026-121392.md)
  `CVE-2026-121392` · CVE record: FreeRDP FreeRDP · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Weak cryptography or TLS
- [Improper signature verification in Dell Alienware Command Center (AWCC)](https://agentprime.io/advisories/CVE-2026-91899.md)
  `CVE-2026-91899` · CVE record: Dell Alienware Command Center (AWCC) · CVSS 6.4 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Weak cryptography or TLS
- [Improper certificate validation in Dell Alienware Command Center (AWCC)](https://agentprime.io/advisories/CVE-2026-91897.md)
  `CVE-2026-91897` · CVE record: Dell Alienware Command Center (AWCC) · CVSS 6.4 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Weak cryptography or TLS
- [Improper signature verification in Dell Alienware Command Center (AWCC)](https://agentprime.io/advisories/CVE-2026-91898.md)
  `CVE-2026-91898` · CVE record: Dell Alienware Command Center (AWCC) · CVSS 8.1 High · Not analysed yet · Published 2 Nov 2026 · Tags: Weak cryptography or TLS
- [python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key](https://agentprime.io/advisories/CVE-2026-120459.md)
  `CVE-2026-120459` · CVE record: mpdavis python-jose · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Weak cryptography or TLS
- [Improper signature verification in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-91905.md)
  `CVE-2026-91905` · CVE record: Dell OpenManage Enterprise · CVSS 6.4 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Weak cryptography or TLS
- [Improper signature verification in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-91908.md)
  `CVE-2026-91908` · CVE record: Dell OpenManage Enterprise · CVSS 5.7 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Weak cryptography or TLS
- [@fastify/secure-session vulnerable to signature verification bypass via cookie signature removal](https://agentprime.io/advisories/CVE-2026-117549.md)
  `CVE-2026-117549` · CVE record: @fastify/secure-session @fastify/secure-session · CVSS 4.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Weak cryptography or TLS
- [Oray Pugongying X5 Pro Session ID session.lua session_get random values](https://agentprime.io/advisories/CVE-2026-120223.md)
  `CVE-2026-120223` · CVE record: Oray Pugongying X5 Pro · CVSS 2.3 Low · Not analysed yet · Published 1 Nov 2026 · Tags: Weak cryptography or TLS, CWE-310
- [Gitea Actions job token spoofing of instance-signed commits](https://agentprime.io/advisories/CVE-2026-116474.md)
  `CVE-2026-116474` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Weak cryptography or TLS
- [OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections](https://agentprime.io/advisories/CVE-2026-120250.md)
  `CVE-2026-120250` · CVE record: marketcalls OpenAlgo · CVSS 6.0 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Weak cryptography or TLS
- [Visual Studio Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-118147.md)
  `CVE-2026-118147` · CVE record: Microsoft Microsoft Visual Studio 2017 version 15.9 and 3 more · CVSS 7.4 High · Not analysed yet · Published 31 Oct 2026 · Tags: Weak cryptography or TLS
- [Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone](https://agentprime.io/advisories/CVE-2026-117681.md)
  `CVE-2026-117681` · CVE record · CVSS 8.0 High · Not analysed yet · Published 31 Oct 2026 · Tags: Weak cryptography or TLS
- [Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store](https://agentprime.io/advisories/GHSA-4487-j8r4-4g2f.md)
  `GHSA-4487-j8r4-4g2f`, `CVE-2026-118780` · npm `node-forge`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 3.7 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS, CWE-471
- [Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13](https://agentprime.io/advisories/GHSA-5x38-2vff-x55p.md)
  `GHSA-5x38-2vff-x55p`, `CVE-2026-119190` · npm `node-forge`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 7.4 High · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS, CWE-436
- [AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery](https://agentprime.io/advisories/GHSA-wm25-49w3-5qrg.md)
  `GHSA-wm25-49w3-5qrg`, `CVE-2026-96629`, `PKSA-1q5j-gcpm-qr2y` · Packagist `adminneo-org/adminneo`: affected `<5.5.1`, fixed in `5.5.1` · CVSS 6.8 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS, Cross-site request forgery (CSRF)
- [LightSAML: Signature reference wrapping permits unsigned assertion claims](https://agentprime.io/advisories/CVE-2026-63182.md)
  `CVE-2026-63182` · CVE record: litesaml lightsaml · CVSS 8.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS
- [ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary](https://agentprime.io/advisories/GHSA-7gw2-hphm-c5px.md)
  `GHSA-7gw2-hphm-c5px`, `CVE-2026-117666`, `EEF-CVE-2026-117666` · Hex `ssl_verify_fun`: affected `>=1.0.1, <1.1.8`, fixed in `1.1.8` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS
- [Improper certificate validation in JetBrains Toolbox App and others](https://agentprime.io/advisories/CVE-2026-118697.md)
  `CVE-2026-118697` · CVE record: JetBrains Toolbox App and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS
- [Improper certificate validation in the HTTPS listener in LXD](https://agentprime.io/advisories/CVE-2026-112816.md)
  `CVE-2026-112816` · CVE record: Canonical LXD · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS
- [CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()](https://agentprime.io/advisories/CVE-2026-118986.md)
  `CVE-2026-118986` · CVE record · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS
- [CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key](https://agentprime.io/advisories/CVE-2026-118991.md)
  `CVE-2026-118991` · CVE record · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS
- [CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes](https://agentprime.io/advisories/CVE-2026-13576.md)
  `CVE-2026-13576` · CVE record · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS, CWE-759
- [Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty](https://agentprime.io/advisories/CVE-2026-119037.md)
  `CVE-2026-119037` · CVE record · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS
- [phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer](https://agentprime.io/advisories/CVE-2026-119561.md)
  `CVE-2026-119561` · CVE record: phpMyAdmin phpMyAdmin · CVSS 7.6 High · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS
- [OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch](https://agentprime.io/advisories/CVE-2026-119559.md)
  `CVE-2026-119559` · CVE record: litespeedtech openlitespeed · CVSS 8.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS
- [Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264](https://agentprime.io/advisories/CVE-2026-118559.md)
  `CVE-2026-118559` · CVE record: Drupal Commerce Stripe · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS
- [Delinea Privilege Manager agent unauthenticated remote code execution vulnerability](https://agentprime.io/advisories/CVE-2026-92744.md)
  `CVE-2026-92744` · CVE record: Delinea Privilege Manager · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Weak cryptography or TLS, Authentication bypass
- [Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage](https://agentprime.io/advisories/CVE-2026-119189.md)
  `CVE-2026-119189` · CVE record: digitalbazaar forge · CVSS 5.9 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Weak cryptography or TLS
- [Forge: Certificate signature verified with the issuer's RSA signature scheme](https://agentprime.io/advisories/CVE-2026-118774.md)
  `CVE-2026-118774` · CVE record: digitalbazaar forge · CVSS 3.7 Low · Not analysed yet · Published 29 Oct 2026 · Tags: Weak cryptography or TLS

Older: <https://agentprime.io/advisories/tag/weak-crypto.md?cursor=WyIyMDI2LTEwLTI5VDE4OjMzOjQ2LjM5OTAwMFoiLCJDVkUtMjAyNi0xMTg3NzQiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=weak-crypto>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/weak-crypto/>. Everything for agents: <https://agentprime.io/llms.txt>.