# Weak cryptography or TLS.

Weak algorithms, randomness, signatures or certificate checks. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Weak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® Classic](https://agentprime.io/advisories/CVE-2026-77805.md)
  `CVE-2026-77805` · CVE record: Progress Software Progress® Telerik® Fiddler® Classic · CVSS 7.9 High · Not analysed yet · Published 5 Oct 2026 · Tags: Weak cryptography or TLS
- [sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission](https://agentprime.io/advisories/CVE-2026-105245.md)
  `CVE-2026-105245` · CVE record: sgl-project sglang · CVSS 6.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Weak cryptography or TLS, CWE-310
- [SourceCodester Drug Recommendation System Password add_user.php missing encryption](https://agentprime.io/advisories/CVE-2026-105179.md)
  `CVE-2026-105179` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Weak cryptography or TLS, CWE-310
- [maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification](https://agentprime.io/advisories/CVE-2026-105223.md)
  `CVE-2026-105223` · CVE record: maclof kubernetes-client · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Weak cryptography or TLS
- [An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext](https://agentprime.io/advisories/CVE-2026-78860.md)
  `CVE-2026-78860` · CVE record · CVSS 7.8 High · Not analysed yet · Published 5 Oct 2026 · Tags: Weak cryptography or TLS
- [alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer](https://agentprime.io/advisories/CVE-2026-105222.md)
  `CVE-2026-105222` · CVE record: alexpechkarev google-maps · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Weak cryptography or TLS
- [Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification](https://agentprime.io/advisories/CVE-2026-105221.md)
  `CVE-2026-105221` · CVE record: defunkt gist · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Weak cryptography or TLS
- [gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client](https://agentprime.io/advisories/CVE-2026-105218.md)
  `CVE-2026-105218` · CVE record: go-pay gopay · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Weak cryptography or TLS
- [Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php](https://agentprime.io/advisories/CVE-2026-105217.md)
  `CVE-2026-105217` · CVE record: cockpit-hq cockpit · CVSS 2.3 Low · Not analysed yet · Published 4 Oct 2026 · Tags: Weak cryptography or TLS
- [go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper](https://agentprime.io/advisories/CVE-2026-105216.md)
  `CVE-2026-105216` · CVE record: micro go-micro · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Weak cryptography or TLS
- [invariant-systems-ai aiir Policy Gate signature verification](https://agentprime.io/advisories/CVE-2026-105161.md)
  `CVE-2026-105161` · CVE record: invariant-systems-ai aiir · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Weak cryptography or TLS, CWE-345
- [YzmCMS MD5 system.func.php password weak password hash](https://agentprime.io/advisories/CVE-2026-105156.md)
  `CVE-2026-105156` · CVE record: YzmCMS · CVSS 6.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Weak cryptography or TLS
- [OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession](https://agentprime.io/advisories/CVE-2026-105118.md)
  `CVE-2026-105118` · CVE record: OpenIdentityPlatform OpenAM · CVSS 2.3 Low · Not analysed yet · Published 3 Oct 2026 · Tags: Weak cryptography or TLS
- [BLS12-381 key validation accepts a public key built on a foreign curve](https://agentprime.io/advisories/CVE-2026-71891.md)
  `CVE-2026-71891` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA · CVSS 7.1 High · Not analysed yet · Published 3 Oct 2026 · Tags: Weak cryptography or TLS
- [MLS X.509 credential not bound to the LeafNode signature key](https://agentprime.io/advisories/CVE-2026-71885.md)
  `CVE-2026-71885` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [OpenPGP data signature accepted from a signing subkey without cross-certification](https://agentprime.io/advisories/CVE-2026-71887.md)
  `CVE-2026-71887` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA · CVSS 8.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: Weak cryptography or TLS, CWE-345
- [PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate](https://agentprime.io/advisories/CVE-2026-71889.md)
  `CVE-2026-71889` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Oct 2026 · Tags: Weak cryptography or TLS
- [Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match](https://agentprime.io/advisories/CVE-2026-85088.md)
  `CVE-2026-85088` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Weak cryptography or TLS
- [Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op](https://agentprime.io/advisories/CVE-2026-85087.md)
  `CVE-2026-85087` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Weak cryptography or TLS, CWE-393
- [Apache Thrift: Perl TLS client disables certificate verification by default](https://agentprime.io/advisories/CVE-2026-85086.md)
  `CVE-2026-85086` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Weak cryptography or TLS, CWE-1188
- [Improper signature verification in Moxa MGate MB3170 Series and others](https://agentprime.io/advisories/CVE-2026-86326.md)
  `CVE-2026-86326` · CVE record: Moxa MGate MB3170 Series and 1 more · CVSS 8.6 High · Not analysed yet · Published 2 Oct 2026 · Tags: Weak cryptography or TLS
- [Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot Platform](https://agentprime.io/advisories/CVE-2026-80443.md)
  `CVE-2026-80443` · CVE record: HAVELSAN Inc. Sef - AI Chatbot Platform · CVSS 7.4 High · Not analysed yet · Published 2 Oct 2026 · Tags: Weak cryptography or TLS
- [Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts](https://agentprime.io/advisories/CVE-2026-103602.md)
  `CVE-2026-103602` · CVE record: Legion of the Bouncy Castle Inc. bc-csharp · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Weak cryptography or TLS
- [Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix](https://agentprime.io/advisories/CVE-2026-63577.md)
  `CVE-2026-63577` · CVE record: Legion of the Bouncy Castle Inc. bc-csharp · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Weak cryptography or TLS
- [URI name constraints checked against a mis-parsed host](https://agentprime.io/advisories/CVE-2026-63576.md)
  `CVE-2026-63576` · CVE record: Legion of the Bouncy Castle Inc. bc-csharp · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Weak cryptography or TLS
- [Attribute certificate path validation does not verify the attribute certificate's signature](https://agentprime.io/advisories/CVE-2026-63571.md)
  `CVE-2026-63571` · CVE record: Legion of the Bouncy Castle Inc. bc-csharp · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Weak cryptography or TLS
- [GV-Eye Sensitive information exposure in URL query parameter Vulnerability](https://agentprime.io/advisories/CVE-2026-103098.md)
  `CVE-2026-103098` · CVE record: GeoVision Inc. GV-Eye · CVSS 7.5 High · Not analysed yet · Published 2 Oct 2026 · Tags: Weak cryptography or TLS
- [SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-18397.md)
  `CVE-2026-18397` · CVE record: Thales SConnect · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS, Memory corruption, CWE-130, CWE-252
- [Cleartext transmission of sensitive information in Johnson Controls EasyIO NEO](https://agentprime.io/advisories/CVE-2026-64893.md)
  `CVE-2026-64893` · CVE record: Johnson Controls EasyIO NEO · CVSS 7.3 High · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [PictShare < 3.7.1 Predictable Delete Code via rand()](https://agentprime.io/advisories/CVE-2026-104356.md)
  `CVE-2026-104356` · CVE record: HaschekSolutions pictshare · CVSS 8.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [Unencrypted UDP Control Traffic in Teledyne FLIR Robots running Aware2](https://agentprime.io/advisories/CVE-2026-55396.md)
  `CVE-2026-55396` · CVE record: Teledyne FLIR Aware2 · CVSS 8.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [Unencrypted 802.11 Network in Teledyne FLIR Robots running Aware2](https://agentprime.io/advisories/CVE-2026-55394.md)
  `CVE-2026-55394` · CVE record: Teledyne FLIR Aware2 · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2](https://agentprime.io/advisories/CVE-2026-14984.md)
  `CVE-2026-14984` · CVE record: Teledyne FLIR Aware2 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [Joyland AI WebView accepts invalid SSL certificates](https://agentprime.io/advisories/CVE-2026-102671.md)
  `CVE-2026-102671` · CVE record: Joyland Joyland.ai · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [Joyland AI enables HTTP](https://agentprime.io/advisories/CVE-2026-102670.md)
  `CVE-2026-102670` · CVE record: Joyland Joyland.ai · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [Joyland AI hostname checking disabled](https://agentprime.io/advisories/CVE-2026-102669.md)
  `CVE-2026-102669` · CVE record: Joyland Joyland.ai · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [Joyland AI accepts TLS certificates without validation](https://agentprime.io/advisories/CVE-2026-102668.md)
  `CVE-2026-102668` · CVE record: Joyland Joyland.ai · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover](https://agentprime.io/advisories/CVE-2026-53953.md)
  `CVE-2026-53953` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS, CWE-640
- [Confluent Kafka Python Improper TLS Certificate Validation](https://agentprime.io/advisories/CVE-2026-15911.md)
  `CVE-2026-15911` · CVE record: confluent confluent-kafka · CVSS 7.4 High · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [Fortra BoKS Server Agent adjoin machine-account password generation vulnerability](https://agentprime.io/advisories/CVE-2026-9864.md)
  `CVE-2026-9864` · CVE record: Fortra Core Privileged Access Manager (BoKS) · CVSS 4.8 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67105.md)
  `CVE-2026-67105` · CVE record: HCL Software HCL BigFix Service Management · CVSS 7.4 High · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [Predictable Active Directory service-account passwords in BoKS Manager](https://agentprime.io/advisories/CVE-2026-79901.md)
  `CVE-2026-79901` · CVE record: Fortra BoKS Manager boks-server · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [Apache APISIX: unauthenticated impersonation issue in saml-auth](https://agentprime.io/advisories/CVE-2026-94212.md)
  `CVE-2026-94212` · CVE record: Apache Software Foundation Apache APISIX · CVSS 6.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification](https://agentprime.io/advisories/CVE-2026-103245.md)
  `CVE-2026-103245` · CVE record: n8n-io n8n · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [Authentication information or sensitive data may be intercepted in transit](https://agentprime.io/advisories/CVE-2026-82826.md)
  `CVE-2026-82826` · CVE record: Hitachi Industrial Equipment Systems Hitachi Coding Software Suite · CVSS 8.7 High · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange](https://agentprime.io/advisories/GHSA-w3jg-pjxf-73p4.md)
  `GHSA-w3jg-pjxf-73p4`, `CVE-2026-102824` · crates.io `russh`: affected `<0.63.0`, fixed in `0.63.0` · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Weak cryptography or TLS
- [Tugtainer: OIDC id_token claims accepted without signature/audience/expiry verification](https://agentprime.io/advisories/CVE-2026-87004.md)
  `CVE-2026-87004` · CVE record: Quenary tugtainer · CVSS 8.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Weak cryptography or TLS
- [SSLContext.wrap_bio() missing validation of server_hostname parameter](https://agentprime.io/advisories/CVE-2026-19553.md)
  `CVE-2026-19553` · CVE record: Python Software Foundation CPython · CVSS 7.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: Weak cryptography or TLS
- [Improper signature verification in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47554.md)
  `CVE-2026-47554` · CVE record: NVIDIA GeForce and 2 more · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Weak cryptography or TLS
- [UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding](https://agentprime.io/advisories/CVE-2026-55174.md)
  `CVE-2026-55174` · CVE record: shrec UltrafastSecp256k1 · CVSS 5.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Weak cryptography or TLS, CWE-345
- [@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized](https://agentprime.io/advisories/GHSA-m9gg-hp2v-232j.md)
  `GHSA-m9gg-hp2v-232j`, `CVE-2026-101916` · npm `@grpc/grpc-js`: affected `<1.13.6 || >=1.14.0, <1.14.5`, fixed in `1.13.6`, `1.14.5` · CVSS 7.4 High · Not analysed yet · Published 30 Sept 2026 · Tags: Weak cryptography or TLS
- [urllib3: HTTPS proxy TLS configuration may be ignored or overridden](https://agentprime.io/advisories/GHSA-8988-9cw3-xx77.md)
  `GHSA-8988-9cw3-xx77`, `CVE-2026-97687`, `PYSEC-2026-4175` · PyPI `urllib3`: affected `>=1.26.0, <2.8.0`, fixed in `2.8.0` · CVSS 7.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: Weak cryptography or TLS, CWE-440
- [Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation](https://agentprime.io/advisories/CVE-2026-10726.md)
  `CVE-2026-10726` · CVE record: Cato Networks SDP Client · CVSS 6.8 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Weak cryptography or TLS
- [Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade](https://agentprime.io/advisories/CVE-2026-102508.md)
  `CVE-2026-102508` · CVE record: Apache Software Foundation Apache PLC4X · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Weak cryptography or TLS, CWE-757
- [Improper certificate validation in Pgpool Global Development Group Pgpool-II](https://agentprime.io/advisories/CVE-2026-92868.md)
  `CVE-2026-92868` · CVE record: Pgpool Global Development Group Pgpool-II · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Weak cryptography or TLS
- [PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation](https://agentprime.io/advisories/GHSA-9j54-fg26-wv3r.md)
  `GHSA-9j54-fg26-wv3r`, `CVE-2026-102266`, `PYSEC-2026-4143` · PyPI `pyjwt`: affected `>=2.13.0, <2.14.0`, fixed in `2.14.0` · CVSS 7.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: Weak cryptography or TLS
- [PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard](https://agentprime.io/advisories/GHSA-ffc3-869f-jxw9.md)
  `GHSA-ffc3-869f-jxw9`, `CVE-2026-102268`, `PYSEC-2026-4145` · PyPI `pyjwt`: affected `<2.14.0`, fixed in `2.14.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Weak cryptography or TLS
- [PyJWT accepts public JWK containers as HMAC secrets](https://agentprime.io/advisories/GHSA-w2cx-738m-mc7w.md)
  `GHSA-w2cx-738m-mc7w`, `CVE-2026-102273`, `PYSEC-2026-4151` · PyPI `pyjwt`: affected `>=2.13.0, <2.14.0`, fixed in `2.14.0` · CVSS 7.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: Weak cryptography or TLS
- [PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard](https://agentprime.io/advisories/GHSA-p4g4-x82p-q773.md)
  `GHSA-p4g4-x82p-q773`, `CVE-2026-102271`, `PYSEC-2026-4149` · PyPI `pyjwt`: affected `>=2.4.0, <2.14.0`, fixed in `2.14.0` · CVSS 7.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: Weak cryptography or TLS
- [PyJWT BOM Bypass](https://agentprime.io/advisories/GHSA-r6x4-923q-g947.md)
  `GHSA-r6x4-923q-g947`, `CVE-2026-102272`, `PYSEC-2026-4150` · PyPI `pyjwt`: affected `>=2.13.0, <2.14.0`, fixed in `2.14.0` · CVSS 7.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: Weak cryptography or TLS

Newest: <https://agentprime.io/advisories/tag/weak-crypto.md>
Older: <https://agentprime.io/advisories/tag/weak-crypto.md?cursor=WyIyMDI2LTA5LTI5VDIzOjE0OjAwLjAwMDAwMFoiLCJHSFNBLXI2eDQtOTIzcS1nOTQ3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=weak-crypto&cursor=WyIyMDI2LTEwLTA1VDE5OjQ1OjUwLjAxNTAwMFoiLCJDVkUtMjAyNi0xMDU3NjYiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/weak-crypto/?cursor=WyIyMDI2LTEwLTA1VDE5OjQ1OjUwLjAxNTAwMFoiLCJDVkUtMjAyNi0xMDU3NjYiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.