Weak cryptography or TLS.

Improper signature verification in Apple macOS

• Apple macOS
• Weak cryptography or TLS

Improper signature verification in Apple macOS

• Apple macOS
• Weak cryptography or TLS

Unencrypted communication to Active Directory services

• Bizerba BRAIN2
• Weak cryptography or TLS

EXCHANGE OF SENSITIVE INFORMATION IN CLEAR TEXT

• Circutor TCPRS1plus
• Weak cryptography or TLS

Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext

• Nagios Log Server
• Weak cryptography or TLS

Constellation has insecure LUKS2 persistent storage partitions which may be opened and used in github.com/edgelesssys/constellation

• Weak cryptography or TLS

* · no fixed version yet

Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO

• Arista Networks DANZ Monitoring Fabric
• Weak cryptography or TLS

Non-Compliant TLS Configuration

• Azure Access Technology BLU-IC2
• Azure Access Technology BLU-IC4
• Weak cryptography or TLS

Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form

• Weak cryptography or TLS

<=1.0 · no fixed version yet

Jenkins ByteGuard Build Actions Plugin does not mask API tokens displayed on the job configuration form

• Weak cryptography or TLS

<=1.0 · no fixed version yet

Jenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job config.xml files

• Weak cryptography or TLS

<=1.0.57 · no fixed version yet

Jenkins ByteGuard Build Actions Plugin stores API tokens unencrypted in job config.xml files

• Weak cryptography or TLS

<=1.0 · no fixed version yet

Jenkins Curseforge Publisher Plugin stores API Keys unencrypted in job config.xml files

• Weak cryptography or TLS

<=1.0 · no fixed version yet

Contrast has insecure LUKS2 persistent storage partitions may be opened and used

• Weak cryptography or TLS
• Information disclosure

<1.12.1 · fixed in 1.12.1

D-Link DAP-2695 Firmware Update sub_40C6B8 signature verification

• D-Link DAP-2695
• Weak cryptography or TLS
• CWE-345

An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the admin…

• Information disclosure
• Weak cryptography or TLS

Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution

• Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Deck Mate 1
• Weak cryptography or TLS
• CWE-1326

Shuffle Master Deck Mate 2 Insecure Update Chain

• Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Deck Mate 2
• Hard-coded credentials
• Weak cryptography or TLS

TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure.

• Authentication bypass
• Weak cryptography or TLS

NeuVector telemetry sender is vulnerable to MITM and DoS

• Weak cryptography or TLS
• Denial of service

>=0.0.0-20230727023453-1c4957d53911, <0.0.0-20251020133207-084a437033b4 · fixed in 0.0.0-20251020133207-084a437033b4

Unencrypted cleartext communication in EfficientLab WorkExaminer Professional

• EfficientLab WorkExaminer Professional
• Weak cryptography or TLS

Reuse of session IDs in oatpp-mcp leads to session hijacking and prompt hijacking by remote attackers

• oatpp-mcp
• Weak cryptography or TLS

Cleartext transmission of sensitive information in Restaurant Brands International assistant platform

• Restaurant Brands International assistant platform
• Weak cryptography or TLS

HTTP Configuration and Encryption in Transit

• ConnectWise Automate
• Weak cryptography or TLS

Ilevia EVE X1 Server 4.7.18.0.eden Insecure Hashing Algorithm

• Ilevia Srl. EVE X1 Server
• Weak cryptography or TLS

GeoIP processor disables SSL certificate validation when downloading databases

• Weak cryptography or TLS

>=2.7.0, <2.12.2 · fixed in 2.12.2

OpenSearch Data Prepper uses deprecated SSL protocol identifier

• Weak cryptography or TLS

>=2.4.0, <2.12.2 · fixed in 2.12.2

go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents

• Weak cryptography or TLS

<0.9.1 · fixed in 0.9.1

OpenSearch Data Prepper plugins trust all SSL certificates by default

• Weak cryptography or TLS

<2.12.2 · fixed in 2.12.2

Improper certificate validation in Devolutions Server

• Devolutions Server
• Weak cryptography or TLS

Microsoft Security Advisory CVE-2025-55248: .NET Information Disclosure Vulnerability

• Weak cryptography or TLS

>=8.0.0, <8.0.21 || >=9.0.0, <9.0.10 · fixed in 8.0.21, 9.0.10

Improper certificate validation in Lenovo LeCloud Client

• Lenovo LeCloud Client
• Weak cryptography or TLS

Improper certificate validation in Lenovo Universal Device Client

• Lenovo Universal Device Client
• Weak cryptography or TLS

This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0.

• Weak cryptography or TLS

<3.4.4 || >=3.5.0, <3.5.2 · fixed in 3.4.4, 3.5.2

Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate

• Weak cryptography or TLS

<1.55.1 · fixed in 1.55.1

Duplicate Advisory: Microsoft Security Advisory CVE-2025-55248: .NET Information Disclosure Vulnerability

• Weak cryptography or TLS

>=9.0.0, <9.0.10 · fixed in 9.0.10

Windows Hello Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• Weak cryptography or TLS

Improper signature verification in Fortinet FortiClientMac

• Fortinet FortiClientMac
• Weak cryptography or TLS

Improper certificate validation in Fortinet FortiProxy and others

• Fortinet FortiProxy
• Fortinet FortiOS
• Weak cryptography or TLS

Murrelektronik: Unprotected Transport of Credentials

• Murrelektronik Firmware Impact67 Pro 54630
• Murrelektronik Firmware Impact67 Pro 54620
• Weak cryptography or TLS

MongoDB Rust Driver has certificate validation disabled when `tlsInsecure=False` appears in connection string

• Weak cryptography or TLS

<3.2.5 · fixed in 3.2.5

Tomofun Furbo 360/Furbo Mini Password shadow weak hash

• Tomofun Furbo 360
• Tomofun Furbo Mini
• Weak cryptography or TLS

Tomofun Furbo 360/Furbo Mini Bluetooth Low Energy cleartext transmission

• Tomofun Furbo 360
• Tomofun Furbo Mini
• Weak cryptography or TLS
• CWE-310

Tomofun Furbo 360/Furbo Mini HTTP Traffic collect_logs.sh upload_file_to_s3 certificate validation

• Tomofun Furbo 360
• Tomofun Furbo Mini
• Authentication bypass
• Weak cryptography or TLS

Missing encryption of sensitive data in CompuGroup Medical CGM MEDICO

• CompuGroup Medical CGM MEDICO
• Weak cryptography or TLS

Akka.Remote TLS did not properly implement certificate-based authentication

• Authentication bypass
• Weak cryptography or TLS

>=1.2.0, <1.5.52 · fixed in 1.5.52

Broken or risky cryptographic algorithm in Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of… and others

• Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release
• Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025
• Weak cryptography or TLS

Broken or risky cryptographic algorithm in Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of… and others

• Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release
• Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025
• Weak cryptography or TLS

Broken or risky cryptographic algorithm in Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of… and others

• Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release
• Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025
• Weak cryptography or TLS

Cleartext transmission of sensitive information in YoSmart YoLink ecosystem

• YoSmart YoLink ecosystem
• Weak cryptography or TLS

OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()

• cyberlord92 OAuth Single Sign On – SSO (OAuth Client)
• Weak cryptography or TLS

Vasion Print (formerly PrinterLogic) Insecure Password Hashing

• Vasion Print Virtual Appliance Host
• Vasion Print Application
• Weak cryptography or TLS
• CWE-759

Multiple vulnerabilities in AndSoft's e-TMS

• AndSoft e-TMS
• Weak cryptography or TLS

The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) has a cleartext Auth0 cl…

• Weak cryptography or TLS

Crypt::RandomEncryption for Perl uses insecure rand() function during encryption

• QWER Crypt::RandomEncryption
• Weak cryptography or TLS
• CWE-331

Vasion Print (formerly PrinterLogic) Weak SSL/TLS Certificate Validation RCE

• Vasion Print Virtual Appliance Host
• Vasion Print Application
• Weak cryptography or TLS

Formbricks missing JWT signature verification

• formbricks
• Authentication bypass
• Weak cryptography or TLS

IBM Aspera HTTP Gateway information disclosure

• IBM Aspera HTTP Gateway
• Weak cryptography or TLS

Banhammer – Monitor Site Traffic, Block Bad Users and Bots <= 3.4.8 - Unauthenticated Protection Mechanism Bypass

• specialk Banhammer – Monitor Site Traffic, Block Bad Users and Bots
• Weak cryptography or TLS

Unencrypted and Unauthenticated Communication Allows Data Exposure and Manipulation in iMonitor EAM

• iMonitor Software Inc. iMonitor EAM
• Weak cryptography or TLS