# Weak cryptography or TLS. Weak algorithms, randomness, signatures or certificate checks. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs](https://agentprime.io/advisories/CVE-2026-115929.md) `CVE-2026-115929` · CVE record: MongoDB, Inc. Compass · CVSS 7.6 High · Not analysed yet · Published 24 Oct 2026 · Tags: Weak cryptography or TLS - [Tenda F6 Web Management cleartext transmission](https://agentprime.io/advisories/CVE-2026-115797.md) `CVE-2026-115797` · CVE record: Tenda F6 · CVSS 6.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS, CWE-310 - [DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing](https://agentprime.io/advisories/CVE-2026-79981.md) `CVE-2026-79981` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS - [Improper certificate validation in node](https://agentprime.io/advisories/CVE-2026-106069.md) `CVE-2026-106069` · CVE record: nodejs node · CVSS 7.4 High · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS - [Insufficiently random values in node](https://agentprime.io/advisories/CVE-2026-106074.md) `CVE-2026-106074` · CVE record: nodejs node · CVSS 4.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS - [Improper certificate validation in node](https://agentprime.io/advisories/CVE-2026-106072.md) `CVE-2026-106072` · CVE record: nodejs node · CVSS 6.7 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS - [Improper certificate validation in node](https://agentprime.io/advisories/CVE-2026-105483.md) `CVE-2026-105483` · CVE record: nodejs node · CVSS 7.4 High · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS - [Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset](https://agentprime.io/advisories/CVE-2026-46347.md) `CVE-2026-46347` · CVE record: intranda goobi-viewer-core · CVSS 6.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS, CWE-340, CWE-640 - [Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset](https://agentprime.io/advisories/CVE-2026-46346.md) `CVE-2026-46346` · CVE record: intranda goobi-viewer-core · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS, CWE-340, CWE-640 - [XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key](https://agentprime.io/advisories/CVE-2026-55889.md) `CVE-2026-55889` · CVE record: flatpak xdg-desktop-portal · CVSS 8.3 High · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS, CWE-337 - [WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers](https://agentprime.io/advisories/GHSA-6vww-5m28-f26v.md) `GHSA-6vww-5m28-f26v`, `CVE-2026-107685`, `EEF-CVE-2026-107685` · Hex `req_llm`: affected `>=1.9.0, <1.29.0`, fixed in `1.29.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS - [JwtVerifierImpl.Verify does not enforce the JWS \`crit\` header (RFC 7515 §4.1.11)](https://agentprime.io/advisories/CVE-2026-89317.md) `CVE-2026-89317` · CVE record: Eclipse Foundation Eclipse KeyPont - GOSE · CVSS 6.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS, CWE-20, CWE-1288 - [Use of Unsalted MD5 Password Hashes in CGM CLININET](https://agentprime.io/advisories/CVE-2025-30049.md) `CVE-2025-30049` · CVE record: CGM CGM CLININET · CVSS 8.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS - [InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information](https://agentprime.io/advisories/CVE-2026-111594.md) `CVE-2026-111594` · CVE record: InterSystems IRIS for Health · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS - [Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs](https://agentprime.io/advisories/CVE-2026-115374.md) `CVE-2026-115374` · CVE record: lxc incus · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS - [OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack](https://agentprime.io/advisories/CVE-2026-114611.md) `CVE-2026-114611` · CVE record: schorschii OCO-Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS - [PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery](https://agentprime.io/advisories/GHSA-pxh4-856f-4h89.md) `GHSA-pxh4-856f-4h89` · PyPI `pyjwt`: affected `<2.14.0`, fixed in `2.14.0` · CVSS 7.4 High · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS - [subhajitkhan online-clinic-management-system patientregistration.php missing encryption](https://agentprime.io/advisories/CVE-2026-115247.md) `CVE-2026-115247` · CVE record: subhajitkhan online-clinic-management-system · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS, CWE-310 - [Improper certificate validation in OpenVPN 3 Core Library](https://agentprime.io/advisories/CVE-2026-106017.md) `CVE-2026-106017` · CVE record: OpenVPN OpenVPN 3 Core Library · CVSS 6.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS - [Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)](https://agentprime.io/advisories/CVE-2026-21812.md) `CVE-2026-21812` · CVE record: HCL Software AppScan Integration with Azure Boards for ASoC & A360 · CVSS 2.2 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS - [NewType Infortech｜NT OneAPP - Improper Certificate Validation](https://agentprime.io/advisories/CVE-2026-114220.md) `CVE-2026-114220` · CVE record: NewType Infortech NT OneAPP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS - [Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper](https://agentprime.io/advisories/CVE-2026-114642.md) `CVE-2026-114642` · CVE record: traefik traefik · CVSS 7.0 High · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS - [Linksys RE6250 Web Management strcmp random values](https://agentprime.io/advisories/CVE-2026-114576.md) `CVE-2026-114576` · CVE record: Linksys RE6250 · CVSS 6.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS, CWE-310 - [Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130](https://agentprime.io/advisories/CVE-2026-84918.md) `CVE-2026-84918` · CVE record: Drupal Monobank payment API · CVSS 3.7 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS - [SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142](https://agentprime.io/advisories/CVE-2026-87944.md) `CVE-2026-87944` · CVE record: Drupal SAML SSO - Service Provider · CVSS 4.8 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS - [SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145](https://agentprime.io/advisories/CVE-2026-87947.md) `CVE-2026-87947` · CVE record: Drupal SAML SSO - Service Provider · CVSS 4.8 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS - [Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176](https://agentprime.io/advisories/CVE-2026-96375.md) `CVE-2026-96375` · CVE record: Drupal Cloud · CVSS 4.8 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS - [Broken or risky cryptographic algorithm in Oracle Corporation Oracle Java SE and others](https://agentprime.io/advisories/CVE-2026-91403.md) `CVE-2026-91403` · CVE record: Oracle Corporation Oracle Java SE and 2 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Weak cryptography or TLS - [Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns](https://agentprime.io/advisories/CVE-2026-114406.md) `CVE-2026-114406` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Weak cryptography or TLS - [Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement](https://agentprime.io/advisories/CVE-2026-111815.md) `CVE-2026-111815` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Weak cryptography or TLS - [Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin](https://agentprime.io/advisories/CVE-2026-111814.md) `CVE-2026-111814` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Weak cryptography or TLS - [Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role](https://agentprime.io/advisories/CVE-2026-105869.md) `CVE-2026-105869` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Weak cryptography or TLS - [Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure](https://agentprime.io/advisories/CVE-2026-53986.md) `CVE-2026-53986` · CVE record: Girafit Girafit camera app · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Weak cryptography or TLS, Hard-coded credentials - [Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names](https://agentprime.io/advisories/CVE-2026-66392.md) `CVE-2026-66392` · CVE record: Apache Software Foundation Apache bRPC · CVSS 5.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Weak cryptography or TLS - [Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token](https://agentprime.io/advisories/CVE-2026-105996.md) `CVE-2026-105996` · CVE record: Unknown Booking Package · CVSS 4.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Weak cryptography or TLS - [FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation](https://agentprime.io/advisories/CVE-2026-114047.md) `CVE-2026-114047` · CVE record: FreeRDP FreeRDP · CVSS 7.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: Weak cryptography or TLS - [Improper certificate validation in Oracle Corporation Oracle Java SE and others](https://agentprime.io/advisories/CVE-2026-91461.md) `CVE-2026-91461` · CVE record: Oracle Corporation Oracle Java SE and 2 more · CVSS 3.7 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS - [Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates](https://agentprime.io/advisories/CVE-2026-113812.md) `CVE-2026-113812` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS - [Improper signature verification in Google Chrome](https://agentprime.io/advisories/CVE-2026-113229.md) `CVE-2026-113229` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS - [Insufficiently random values in Google Chrome](https://agentprime.io/advisories/CVE-2026-113071.md) `CVE-2026-113071` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS - [Improper certificate validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-113119.md) `CVE-2026-113119` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS - [Improper signature verification in Totolink](https://agentprime.io/advisories/CVE-2026-10141.md) `CVE-2026-10141` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS - [wolfSSL public-key pinning bypass](https://agentprime.io/advisories/CVE-2026-87866.md) `CVE-2026-87866` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS - [knownhost callback mismatches key as missing](https://agentprime.io/advisories/CVE-2026-87865.md) `CVE-2026-87865` · CVE record: curl curl · CVSS 7.4 High · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS - [redirect to SFTP or SCP bypasses host verification](https://agentprime.io/advisories/CVE-2026-86410.md) `CVE-2026-86410` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS - [War Thunder Account Impersonation](https://agentprime.io/advisories/CVE-2026-107692.md) `CVE-2026-107692` · CVE record: Gaijin Entertainment War Thunder · CVSS 4.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS - [uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised](https://agentprime.io/advisories/GHSA-hq85-5cpj-mr62.md) `GHSA-hq85-5cpj-mr62`, `PYSEC-2026-4321` · PyPI `uv`: affected `<0.13.4`, fixed in `0.13.4` · CVSS 4.0, no score published · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS - [Cryptographic issue in the Security Block-lists, Allow-lists, and other State component](https://agentprime.io/advisories/CVE-2026-113470.md) `CVE-2026-113470` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS - [Eclipse ioFog operator WebSocket accepts an unverified JWT](https://agentprime.io/advisories/CVE-2026-113620.md) `CVE-2026-113620` · CVE record: Eclipse Foundation Eclipse ioFog · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS - [Missing encryption of sensitive data in Advantech ADAM-3600](https://agentprime.io/advisories/CVE-2026-43854.md) `CVE-2026-43854` · CVE record: Advantech ADAM-3600 · CVSS 6.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS - [TYPO3-EXT-SA-2026-033: Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)](https://agentprime.io/advisories/PKSA-13xq-tz75-c2tq.md) `PKSA-13xq-tz75-c2tq`, `CVE-2026-112240` · Packagist `codingms/fluid-form`: affected `<5.0.10 || >=6.0.0, <6.0.6`, fixed in `5.0.10`, `6.0.6` · CVSS 6.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS, Broken access control - [IBM Cloud Pak System Risky Cryptographic Algorithm](https://agentprime.io/advisories/CVE-2026-3161.md) `CVE-2026-3161` · CVE record: IBM Cloud Pak System · CVSS 5.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Weak cryptography or TLS - [IBM Concert Software Improper Certificate Validation](https://agentprime.io/advisories/CVE-2026-1501.md) `CVE-2026-1501` · CVE record: IBM Concert · CVSS 3.7 Low · Not analysed yet · Published 19 Oct 2026 · Tags: Weak cryptography or TLS - [IBM Concert Software Use of Insufficiently Random Values](https://agentprime.io/advisories/CVE-2026-6719.md) `CVE-2026-6719` · CVE record: IBM Concert · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2026 · Tags: Weak cryptography or TLS - [IBM Concert Software Risky Cryptographic Algorithm](https://agentprime.io/advisories/CVE-2026-6930.md) `CVE-2026-6930` · CVE record: IBM Concert · CVSS 3.7 Low · Not analysed yet · Published 19 Oct 2026 · Tags: Weak cryptography or TLS - [AIOHTTP: Secure attribute not enforced for shared cookie](https://agentprime.io/advisories/GHSA-494j-54xm-rwp3.md) `GHSA-494j-54xm-rwp3`, `CVE-2026-111063` · PyPI `aiohttp`: affected `<3.14.4`, fixed in `3.14.4` · CVSS 6.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Weak cryptography or TLS, CWE-1004 - [A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request](https://agentprime.io/advisories/GHSA-j7h2-66j4-ghjf.md) `GHSA-j7h2-66j4-ghjf`, `CVE-2026-111062` · crates.io `russh`: affected `>=0.34.0-beta.1, <0.64.0`, fixed in `0.64.0` · CVSS 2.3 Low · Not analysed yet · Published 19 Oct 2026 · Tags: Weak cryptography or TLS - [Missing encryption of sensitive data in Dell Application Installer,](https://agentprime.io/advisories/CVE-2026-86375.md) `CVE-2026-86375` · CVE record: Dell Application Installer, · CVSS 6.2 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Weak cryptography or TLS - [TufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validation](https://agentprime.io/advisories/CVE-2026-112106.md) `CVE-2026-112106` · CVE record: TufayelLUS TikTok-Video-Downloader-PHP · CVSS 6.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS - [Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore](https://agentprime.io/advisories/CVE-2026-85247.md) `CVE-2026-85247` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Weak cryptography or TLS Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .