# Weak cryptography or TLS.

Weak algorithms, randomness, signatures or certificate checks. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [code-projects Chat System MD5 Hash update_user.php weak hash](https://agentprime.io/advisories/CVE-2026-7103.md)
  `CVE-2026-7103` · CVE record: code-projects Chat System · CVSS 6.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Weak cryptography or TLS
- [Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification](https://agentprime.io/advisories/CVE-2026-6986.md)
  `CVE-2026-6986` · CVE record: Cesanta Mongoose · CVSS 6.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Weak cryptography or TLS, CWE-345
- [gitverify has improper tag signature verification](https://agentprime.io/advisories/GHSA-h829-5cg7-6hff.md)
  `GHSA-h829-5cg7-6hff`, `GO-2026-5416` · Go `github.com/supply-chain-tools/gitverify`: affected `<0.0.0-20260421124901-c2c60da05d5c`, fixed in `0.0.0-20260421124901-c2c60da05d5c` · CVSS 4.0, no score published · Not analysed yet · Published 24 Apr 2026 · Tags: Weak cryptography or TLS
- [Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel](https://agentprime.io/advisories/CVE-2026-6911.md)
  `CVE-2026-6911` · CVE record: AWS AWS Ops Wheel · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Apr 2026 · Tags: Weak cryptography or TLS
- [SenseLive X3050 Cleartext transmission of sensitive information](https://agentprime.io/advisories/CVE-2026-40431.md)
  `CVE-2026-40431` · CVE record: SenseLive X3050 · CVSS 6.9 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Weak cryptography or TLS
- [Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege](https://agentprime.io/advisories/GHSA-9mv3-2cwr-p262.md)
  `GHSA-9mv3-2cwr-p262`, `BIT-aspnet-core-2026-40372`, `CVE-2026-40372` · NuGet `Microsoft.AspNetCore.DataProtection`: affected `>=10.0.0, <10.0.7`, fixed in `10.0.7` · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 23 Apr 2026 · Tags: Weak cryptography or TLS
- [CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking](https://agentprime.io/advisories/CVE-2026-41564.md)
  `CVE-2026-41564` · CVE record: MIK CryptX · CVSS 7.5 High · Not analysed yet · Published 23 Apr 2026 · Tags: Weak cryptography or TLS, CWE-335
- [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-5926.md)
  `CVE-2026-5926` · CVE record: IBM Verify Identity Access Container and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Weak cryptography or TLS
- [Gitea has insecure default SSH settings](https://agentprime.io/advisories/GHSA-3m6q-h5gj-7mrw.md)
  `GHSA-3m6q-h5gj-7mrw`, `GO-2026-5091` · Go `code.gitea.io/gitea`: affected `<1.25.0`, fixed in `1.25.0` · CVSS 4.0, no score published · Not analysed yet · Published 22 Apr 2026 · Tags: Weak cryptography or TLS, CWE-1188
- [nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge](https://agentprime.io/advisories/GHSA-pf4j-pf3w-95f9.md)
  `GHSA-pf4j-pf3w-95f9`, `CVE-2026-34068` · crates.io `nimiq-transaction`: affected `<=0.2.0`, no fixed version yet · CVSS 6.8 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Weak cryptography or TLS
- [ELBA5 5.8.0 Remote Code Execution via Database Access](https://agentprime.io/advisories/CVE-2018-25272.md)
  `CVE-2018-25272` · CVE record: Elba ELBA5 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2026 · Tags: Weak cryptography or TLS
- [Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates](https://agentprime.io/advisories/GHSA-2jrg-rf5x-568g.md)
  `GHSA-2jrg-rf5x-568g`, `CVE-2026-22747` · Maven `org.springframework.security:spring-security-web`: affected `>=7.0.0, <7.0.5`, fixed in `7.0.5` · CVSS 6.8 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Weak cryptography or TLS
- [OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate](https://agentprime.io/advisories/GHSA-7ccv-rp6m-rffr.md)
  `GHSA-7ccv-rp6m-rffr`, `BIT-openbao-2026-39388`, `CVE-2026-39388`, `GO-2026-5213` · Go `github.com/openbao/openbao`: affected `<0.0.0-20260420160924-abe84e1af4c3`, fixed in `0.0.0-20260420160924-abe84e1af4c3` · CVSS 2.0 Low · Not analysed yet · Published 21 Apr 2026 · Tags: Weak cryptography or TLS, Broken access control
- [HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption](https://agentprime.io/advisories/CVE-2025-31981.md)
  `CVE-2025-31981` · CVE record: HCLSoftware BigFix Service Management (SM) · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Weak cryptography or TLS
- [Encryption vulnerable to brute-force decryption in GoAnywhere MFT](https://agentprime.io/advisories/CVE-2025-1241.md)
  `CVE-2025-1241` · CVE record: Fortra GoAnywhere MFT · CVSS 5.8 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Weak cryptography or TLS
- [FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force](https://agentprime.io/advisories/CVE-2026-40496.md)
  `CVE-2026-40496` · CVE record: freescout-help-desk freescout · CVSS 8.8 High · Not analysed yet · Published 21 Apr 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Unencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center](https://agentprime.io/advisories/CVE-2026-6066.md)
  `CVE-2026-6066` · CVE record: ConnectWise Automate · CVSS 7.1 High · Not analysed yet · Published 20 Apr 2026 · Tags: Weak cryptography or TLS
- [Broken or risky cryptographic algorithm in silex technology, Inc. SD-330AC and others](https://agentprime.io/advisories/CVE-2026-32959.md)
  `CVE-2026-32959` · CVE record: silex technology, Inc. SD-330AC and 1 more · CVSS 8.2 High · Not analysed yet · Published 20 Apr 2026 · Tags: Weak cryptography or TLS
- [Anviz Products Cleartext Transmission of Sensitive Information](https://agentprime.io/advisories/CVE-2026-33569.md)
  `CVE-2026-33569` · CVE record: Anviz Anviz CX7 Firmware and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Weak cryptography or TLS
- [Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks](https://agentprime.io/advisories/GHSA-574f-3g2m-x479.md)
  `GHSA-574f-3g2m-x479`, `CVE-2025-14813` · Maven `org.bouncycastle:bcprov-debug-jdk14` and 13 more: affected `>=1.59, <=1.80.1 || >=1.82, <1.84`, fixed in `1.84` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: Weak cryptography or TLS, CWE-323
- [Improper certificate validation in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-23776.md)
  `CVE-2026-23776` · CVE record: Dell PowerProtect Data Domain · CVSS 7.2 High · Not analysed yet · Published 17 Apr 2026 · Tags: Weak cryptography or TLS
- [Plonky3: The sponge construction used to get a hash function from a cryptographic permutation is not collision resistant for inputs of different lengths](https://agentprime.io/advisories/GHSA-3g92-f9ch-qjcm.md)
  `GHSA-3g92-f9ch-qjcm` · crates.io `p3-symmetric`: affected `<=0.5.2`, no fixed version yet · CVSS 4.0, no score published · Not analysed yet · Published 16 Apr 2026 · Tags: Weak cryptography or TLS
- [Flowise: Password Reset Link Sent Over Unsecured HTTP](https://agentprime.io/advisories/GHSA-x5w6-38gp-mrqh.md)
  `GHSA-x5w6-38gp-mrqh`, `CVE-2026-41275` · npm `flowise`: affected `<3.1.0`, fixed in `3.1.0` · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2026 · Tags: Weak cryptography or TLS
- [Flowise: Weak Default JWT Secrets](https://agentprime.io/advisories/GHSA-cc4f-hjpj-g9p8.md)
  `GHSA-cc4f-hjpj-g9p8`, `CVE-2026-56271` · npm `flowise`: affected `<3.1.0`, fixed in `3.1.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: Hard-coded credentials, Weak cryptography or TLS
- [Cryptomator Hub OAuth token exchange HTTP downgrade via getAuthority() scheme confusion (CVE-2026-32303 bypass)](https://agentprime.io/advisories/CVE-2026-33472.md)
  `CVE-2026-33472` · CVE record: cryptomator cryptomator · CVSS 4.8 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: Weak cryptography or TLS, CWE-305
- [Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation](https://agentprime.io/advisories/CVE-2026-5050.md)
  `CVE-2026-5050` · CVE record: jconti Payment Gateway for Redsys & WooCommerce Lite · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2026 · Tags: Weak cryptography or TLS
- [Use of weak cryptographic key in TP-Link Archer C7](https://agentprime.io/advisories/CVE-2026-5363.md)
  `CVE-2026-5363` · CVE record: TP-Link Systems Inc. Archer C7 v5 and v5.8 · CVSS 5.4 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: Weak cryptography or TLS
- [Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules](https://agentprime.io/advisories/GHSA-wg6q-6289-32hp.md)
  `GHSA-wg6q-6289-32hp`, `CVE-2026-5588` · Maven `org.bouncycastle:bcpkix-debug-jdk14` and 6 more: affected `>=1.49, <1.84`, fixed in `1.84` · CVSS 6.3 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: Weak cryptography or TLS
- [Cisco Webex Meetings Certificate Validation Vulnerability](https://agentprime.io/advisories/CVE-2026-20184.md)
  `CVE-2026-20184` · CVE record: Cisco Cisco Webex Meetings · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Apr 2026 · Tags: Weak cryptography or TLS
- [Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts](https://agentprime.io/advisories/CVE-2026-5088.md)
  `CVE-2026-5088` · CVE record: JDEGUEST Apache::API::Password · CVSS 7.5 High · Not analysed yet · Published 15 Apr 2026 · Tags: Weak cryptography or TLS
- [XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets](https://agentprime.io/advisories/CVE-2026-6328.md)
  `CVE-2026-6328` · CVE record: XQUIC Project XQUIC · CVSS 8.3 High · Not analysed yet · Published 15 Apr 2026 · Tags: Weak cryptography or TLS, CWE-20
- [Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles](https://agentprime.io/advisories/GHSA-7jrq-q4pq-rhm6.md)
  `GHSA-7jrq-q4pq-rhm6`, `CVE-2026-40944`, `GO-2026-5226` · Go `github.com/oxia-db/oxia`: affected `<0.16.2`, fixed in `0.16.2` · CVSS 6.9 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Weak cryptography or TLS
- [Cleartext transmission of sensitive information in Fortinet FortiSOAR PaaS and others](https://agentprime.io/advisories/CVE-2026-22155.md)
  `CVE-2026-22155` · CVE record: Fortinet FortiSOAR PaaS and 1 more · CVSS 6.2 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Weak cryptography or TLS
- [Cleartext transmission of sensitive information in Fortinet FortiSOAR on-premise and others](https://agentprime.io/advisories/CVE-2026-21742.md)
  `CVE-2026-21742` · CVE record: Fortinet FortiSOAR on-premise and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Weak cryptography or TLS
- [Name constraints were accepted for certificates asserting a wildcard name](https://agentprime.io/advisories/GHSA-xgp8-3hg3-c2mh.md)
  `GHSA-xgp8-3hg3-c2mh`, `CVE-2026-93601`, `RUSTSEC-2026-0099` · crates.io `rustls-webpki`: affected `>=0.0.0-0, <0.103.12 || >=0.104.0-alpha.1, <0.104.0-alpha.6`, fixed in `0.103.12`, `0.104.0-alpha.6` · CVSS 2.1 Low · Not analysed yet · Published 14 Apr 2026 · Tags: Weak cryptography or TLS
- [Name constraints for URI names were incorrectly accepted](https://agentprime.io/advisories/GHSA-965h-392x-2mh5.md)
  `GHSA-965h-392x-2mh5`, `CVE-2026-93600`, `RUSTSEC-2026-0098` · crates.io `rustls-webpki`: affected `>=0.0.0-0, <0.103.12 || >=0.104.0-alpha.1, <0.104.0-alpha.6`, fixed in `0.103.12`, `0.104.0-alpha.6` · CVSS 2.1 Low · Not analysed yet · Published 14 Apr 2026 · Tags: Weak cryptography or TLS
- [Improper signature verification in Siemens SINEC NMS](https://agentprime.io/advisories/CVE-2026-24032.md)
  `CVE-2026-24032` · CVE record: Siemens SINEC NMS · CVSS 6.9 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Weak cryptography or TLS
- [Improper certificate validation in Siemens Software Center and others](https://agentprime.io/advisories/CVE-2025-40745.md)
  `CVE-2025-40745` · CVE record: Siemens Siemens Software Center and 4 more · CVSS 6.3 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Weak cryptography or TLS
- [Apache APISIX: Openid-connect \`tls_verify\` field is disabled by default](https://agentprime.io/advisories/CVE-2026-31923.md)
  `CVE-2026-31923` · CVE record: Apache Software Foundation Apache APISIX · CVSS 7.5 High · Not analysed yet · Published 14 Apr 2026 · Tags: Weak cryptography or TLS
- [Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP](https://agentprime.io/advisories/CVE-2026-31924.md)
  `CVE-2026-31924` · CVE record: Apache Software Foundation Apache APISIX · CVSS 5.3 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Weak cryptography or TLS
- [Sigstore Timestamp Authority has Improper Certificate Validation in verifier](https://agentprime.io/advisories/GHSA-xm5m-wgh2-rrg3.md)
  `GHSA-xm5m-wgh2-rrg3`, `CVE-2026-39984`, `GO-2026-5763` · Go `github.com/sigstore/timestamp-authority/v2`: affected `<2.0.6`, fixed in `2.0.6` · CVSS 5.5 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Weak cryptography or TLS
- [jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed](https://agentprime.io/advisories/CVE-2026-40164.md)
  `CVE-2026-40164` · CVE record: jqlang jq · CVSS 7.5 High · Not analysed yet · Published 13 Apr 2026 · Tags: Weak cryptography or TLS, Denial of service, CWE-341
- [Autonomous Digital Experience Manager: Improper validation of ADEM certificate](https://agentprime.io/advisories/CVE-2026-0233.md)
  `CVE-2026-0233` · CVE record: Palo Alto Networks Autonomous Digital Experience Manager · CVSS 2.0 Low · Not analysed yet · Published 13 Apr 2026 · Tags: Weak cryptography or TLS
- [Cortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integration](https://agentprime.io/advisories/CVE-2026-0234.md)
  `CVE-2026-0234` · CVE record: Palo Alto Networks Cortex XSOAR Microsoft Teams Marketplace and 1 more · CVSS 7.2 High · Not analysed yet · Published 13 Apr 2026 · Tags: Weak cryptography or TLS
- [Solstice::Session versions through 1440 for Perl generates session ids insecurely](https://agentprime.io/advisories/CVE-2026-5085.md)
  `CVE-2026-5085` · CVE record: MCRAWFOR Solstice::Session · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Apr 2026 · Tags: Weak cryptography or TLS, CWE-340
- [DNN: Same HostGUID for all new installs](https://agentprime.io/advisories/GHSA-2rhw-gw3f-477j.md)
  `GHSA-2rhw-gw3f-477j`, `CVE-2026-40306` · NuGet `DotNetNuke.Core`: affected `>=10.0.0, <10.2.2`, fixed in `10.2.2` · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Weak cryptography or TLS
- [Chamilo LMS has Weak REST API Key Generation (Predictable)](https://agentprime.io/advisories/CVE-2026-33710.md)
  `CVE-2026-33710` · CVE record: chamilo chamilo-lms · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2026 · Tags: Weak cryptography or TLS
- [Apache Log4j Core: \`verifyHostName\` attribute silently ignored in TLS configuration](https://agentprime.io/advisories/GHSA-6hg6-v5c8-fphq.md)
  `GHSA-6hg6-v5c8-fphq`, `CVE-2026-34477` · Maven `org.apache.logging.log4j:log4j-core`: affected `>=2.12.0, <2.25.4 || >=3.0.0-alpha1, <=3.0.0-beta3`, fixed in `2.25.4` · CVSS 6.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Weak cryptography or TLS
- [Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install](https://agentprime.io/advisories/GHSA-q5jf-9vfq-h4h7.md)
  `GHSA-q5jf-9vfq-h4h7`, `BIT-helm-2026-35205`, `CVE-2026-35205`, `GO-2026-5566` · Go `helm.sh/helm/v4`: affected `>=4.0.0, <4.1.4`, fixed in `4.1.4` · CVSS 8.4 High · Not analysed yet · Published 10 Apr 2026 · Tags: Weak cryptography or TLS, CWE-636
- [Improper Certificate Signature Verification in X.509 Chain Validation Allows Forged Leaf Certificates](https://agentprime.io/advisories/CVE-2026-5501.md)
  `CVE-2026-5501` · CVE record: wolfSSL wolfSSL · CVSS 8.6 High · Not analysed yet · Published 10 Apr 2026 · Tags: Weak cryptography or TLS
- [wc_VerifyEccsiHash missing sanity check](https://agentprime.io/advisories/CVE-2026-5466.md)
  `CVE-2026-5466` · CVE record: wolfSSL wolfSSL · CVSS 7.6 High · Not analysed yet · Published 10 Apr 2026 · Tags: Weak cryptography or TLS
- [Apache Tomcat Missing Encryption of Sensitive Data vulnerability](https://agentprime.io/advisories/GHSA-69r9-qgr7-g2wj.md)
  `GHSA-69r9-qgr7-g2wj`, `BIT-tomcat-2026-34486`, `CVE-2026-34486` · Maven `org.apache.tomcat:tomcat` and 1 more: affected `>=11.0.20, <11.0.21 || >=10.1.53, <10.1.54 || >=9.0.116, <9.0.117`, fixed in `11.0.21`, `10.1.54`, `9.0.117` · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.99 · Not analysed yet · Published 9 Apr 2026 · Tags: Weak cryptography or TLS, CWE-807
- [Apache Tomcat: Configured cipher preference order not preserved](https://agentprime.io/advisories/GHSA-69cc-cv78-qc8g.md)
  `GHSA-69cc-cv78-qc8g`, `BIT-tomcat-2026-29129`, `CVE-2026-29129` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=9.0.114, <9.0.116 || >=10.1.51, <10.1.53 || >=11.0.16, <11.0.20`, fixed in `9.0.116`, `10.1.53`, `11.0.20` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: Weak cryptography or TLS
- [URI nameConstraints not enforced in ConfirmNameConstraints()](https://agentprime.io/advisories/CVE-2026-5263.md)
  `CVE-2026-5263` · CVE record: wolfSSL wolfSSL · CVSS 7.0 High · Not analysed yet · Published 9 Apr 2026 · Tags: Weak cryptography or TLS
- [bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)](https://agentprime.io/advisories/GHSA-hc36-c89j-5f4j.md)
  `GHSA-hc36-c89j-5f4j`, `CVE-2026-40070` · RubyGems `bsv-sdk` and 1 more: affected `>=0.3.1, <0.8.2`, fixed in `0.8.2` · CVSS 8.1 High · Not analysed yet · Published 9 Apr 2026 · Tags: Weak cryptography or TLS
- [wolfSSL ECDSA Certificate Verification](https://agentprime.io/advisories/CVE-2026-5194.md)
  `CVE-2026-5194` · CVE record: wolfSSL wolfSSL · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Apr 2026 · Tags: Weak cryptography or TLS
- [deepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote server](https://agentprime.io/advisories/CVE-2026-35207.md)
  `CVE-2026-35207` · CVE record: linuxdeepin dde-control-center and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Weak cryptography or TLS
- [Weak encryption in Google Chrome](https://agentprime.io/advisories/CVE-2026-5889.md)
  `CVE-2026-5889` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Weak cryptography or TLS
- [rfc3161-client Has Improper Certificate Validation](https://agentprime.io/advisories/GHSA-3xxc-pwj6-jgrj.md)
  `GHSA-3xxc-pwj6-jgrj`, `CVE-2026-33753`, `PYSEC-2026-3051` · PyPI `rfc3161-client`: affected `<1.0.6`, fixed in `1.0.6` · CVSS 6.2 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Weak cryptography or TLS
- [Ado::Sessions versions through 0.935 for Perl generates insecure session ids](https://agentprime.io/advisories/CVE-2026-5083.md)
  `CVE-2026-5083` · CVE record: BEROV Ado::Sessions · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Weak cryptography or TLS, CWE-340

Newest: <https://agentprime.io/advisories/tag/weak-crypto.md>
Older: <https://agentprime.io/advisories/tag/weak-crypto.md?cursor=WyIyMDI2LTA0LTA4VDA1OjUzOjE2Ljk2MzAwMFoiLCJDVkUtMjAyNi01MDgzIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=weak-crypto&cursor=WyIyMDI2LTA0LTI3VDE0OjIxOjQwLjU2NDAwMFoiLCJDVkUtMjAyNi00MDUxNCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/weak-crypto/?cursor=WyIyMDI2LTA0LTI3VDE0OjIxOjQwLjU2NDAwMFoiLCJDVkUtMjAyNi00MDUxNCJd>. Everything for agents: <https://agentprime.io/llms.txt>.