Weak cryptography or TLS.

code-projects Chat System MD5 Hash update_user.php weak hash

• code-projects Chat System
• Weak cryptography or TLS

Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification

• Cesanta Mongoose
• Weak cryptography or TLS
• CWE-345

gitverify has improper tag signature verification

• Weak cryptography or TLS

<0.0.0-20260421124901-c2c60da05d5c · fixed in 0.0.0-20260421124901-c2c60da05d5c

Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel

• AWS Ops Wheel
• Weak cryptography or TLS

SenseLive X3050 Cleartext transmission of sensitive information

• SenseLive X3050
• Weak cryptography or TLS

Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege

• Weak cryptography or TLS

>=10.0.0, <10.0.7 · fixed in 10.0.7

CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking

• MIK CryptX
• Weak cryptography or TLS
• CWE-335

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

• IBM Verify Identity Access Container
• IBM Security Verify Access Container
• Weak cryptography or TLS

Gitea has insecure default SSH settings

• Weak cryptography or TLS
• CWE-1188

<1.25.0 · fixed in 1.25.0

nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge

• Weak cryptography or TLS

<=0.2.0 · no fixed version yet

ELBA5 5.8.0 Remote Code Execution via Database Access

• ELBA5
• Weak cryptography or TLS

Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

• Weak cryptography or TLS

>=7.0.0, <7.0.5 · fixed in 7.0.5

OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate

• Weak cryptography or TLS
• Broken access control

<0.0.0-20260420160924-abe84e1af4c3 · fixed in 0.0.0-20260420160924-abe84e1af4c3

HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption

• HCLSoftware BigFix Service Management (SM)
• Weak cryptography or TLS

Encryption vulnerable to brute-force decryption in GoAnywhere MFT

• Fortra GoAnywhere MFT
• Weak cryptography or TLS

FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force

• freescout
• Weak cryptography or TLS
• CWE-340

Unencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center

• ConnectWise Automate
• Weak cryptography or TLS

Broken or risky cryptographic algorithm in silex technology, Inc. SD-330AC and others

• silex technology, Inc. SD-330AC
• silex technology, Inc. AMC Manager
• Weak cryptography or TLS

Anviz Products Cleartext Transmission of Sensitive Information

• Anviz CX7 Firmware
• Anviz CX2 Lite Firmware
• Weak cryptography or TLS

Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks

• Weak cryptography or TLS
• CWE-323

>=1.59, <=1.80.1 || >=1.82, <1.84 · fixed in 1.84

Improper certificate validation in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Weak cryptography or TLS

Plonky3: The sponge construction used to get a hash function from a cryptographic permutation is not collision resistant for inputs of different lengths

• Weak cryptography or TLS

<=0.5.2 · no fixed version yet

Flowise: Password Reset Link Sent Over Unsecured HTTP

• Weak cryptography or TLS

<3.1.0 · fixed in 3.1.0

Flowise: Weak Default JWT Secrets

• Hard-coded credentials
• Weak cryptography or TLS

<3.1.0 · fixed in 3.1.0

Cryptomator Hub OAuth token exchange HTTP downgrade via getAuthority() scheme confusion (CVE-2026-32303 bypass)

• cryptomator
• Weak cryptography or TLS
• CWE-305

Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation

• jconti Payment Gateway for Redsys & WooCommerce Lite
• Weak cryptography or TLS

Use of weak cryptographic key in TP-Link Archer C7

• TP-Link Systems Inc. Archer C7 v5 and v5.8
• Weak cryptography or TLS

Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

• Weak cryptography or TLS

>=1.49, <1.84 · fixed in 1.84

Cisco Webex Meetings Certificate Validation Vulnerability

• Cisco Webex Meetings
• Weak cryptography or TLS

Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts

• JDEGUEST Apache::API::Password
• Weak cryptography or TLS

XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets

• XQUIC
• Weak cryptography or TLS
• CWE-20

Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles

• Weak cryptography or TLS

<0.16.2 · fixed in 0.16.2

Cleartext transmission of sensitive information in Fortinet FortiSOAR PaaS and others

• Fortinet FortiSOAR PaaS
• Fortinet FortiSOAR on-premise
• Weak cryptography or TLS

Cleartext transmission of sensitive information in Fortinet FortiSOAR on-premise and others

• Fortinet FortiSOAR on-premise
• Fortinet FortiSOAR PaaS
• Weak cryptography or TLS

Name constraints were accepted for certificates asserting a wildcard name

• Weak cryptography or TLS

>=0.0.0-0, <0.103.12 || >=0.104.0-alpha.1, <0.104.0-alpha.6 · fixed in 0.103.12, 0.104.0-alpha.6

Name constraints for URI names were incorrectly accepted

• Weak cryptography or TLS

>=0.0.0-0, <0.103.12 || >=0.104.0-alpha.1, <0.104.0-alpha.6 · fixed in 0.103.12, 0.104.0-alpha.6

Improper signature verification in Siemens SINEC NMS

• Siemens SINEC NMS
• Weak cryptography or TLS

Improper certificate validation in Siemens Software Center and others

• Siemens Software Center
• Siemens Simcenter 3D
• Weak cryptography or TLS

Apache APISIX: Openid-connect `tls_verify` field is disabled by default

• Apache Software Foundation Apache APISIX
• Weak cryptography or TLS

Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP

• Apache Software Foundation Apache APISIX
• Weak cryptography or TLS

Sigstore Timestamp Authority has Improper Certificate Validation in verifier

• Weak cryptography or TLS

<2.0.6 · fixed in 2.0.6

jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed

• jq
• Weak cryptography or TLS
• Denial of service

Autonomous Digital Experience Manager: Improper validation of ADEM certificate

• Palo Alto Networks Autonomous Digital Experience Manager
• Weak cryptography or TLS

Cortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integration

• Palo Alto Networks Cortex XSOAR Microsoft Teams Marketplace
• Palo Alto Networks Cortex XSIAM Microsoft Teams Marketplace
• Weak cryptography or TLS

Solstice::Session versions through 1440 for Perl generates session ids insecurely

• MCRAWFOR Solstice::Session
• Weak cryptography or TLS
• CWE-340

DNN: Same HostGUID for all new installs

• Weak cryptography or TLS

>=10.0.0, <10.2.2 · fixed in 10.2.2

Chamilo LMS has Weak REST API Key Generation (Predictable)

• chamilo-lms
• Weak cryptography or TLS

Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration

• Weak cryptography or TLS

>=2.12.0, <2.25.4 || >=3.0.0-alpha1, <=3.0.0-beta3 · fixed in 2.25.4

Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

• Weak cryptography or TLS
• CWE-636

>=4.0.0, <4.1.4 · fixed in 4.1.4

Improper Certificate Signature Verification in X.509 Chain Validation Allows Forged Leaf Certificates

• wolfSSL
• Weak cryptography or TLS

wc_VerifyEccsiHash missing sanity check

• wolfSSL
• Weak cryptography or TLS

Apache Tomcat Missing Encryption of Sensitive Data vulnerability

• Weak cryptography or TLS
• CWE-807

>=11.0.20, <11.0.21 || >=10.1.53, <10.1.54 || >=9.0.116, <9.0.117 · fixed in 11.0.21, 10.1.54, 9.0.117

Apache Tomcat: Configured cipher preference order not preserved

• Weak cryptography or TLS

>=9.0.114, <9.0.116 || >=10.1.51, <10.1.53 || >=11.0.16, <11.0.20 · fixed in 9.0.116, 10.1.53, 11.0.20

URI nameConstraints not enforced in ConfirmNameConstraints()

• wolfSSL
• Weak cryptography or TLS

bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

• Weak cryptography or TLS

>=0.3.1, <0.8.2 · fixed in 0.8.2

wolfSSL ECDSA Certificate Verification

• wolfSSL
• Weak cryptography or TLS

deepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote server

• linuxdeepin dde-control-center
• linuxdeepin deepin-deepinid-plugin
• Weak cryptography or TLS

Weak encryption in Google Chrome

• Google Chrome
• Weak cryptography or TLS

rfc3161-client Has Improper Certificate Validation

• Weak cryptography or TLS

<1.0.6 · fixed in 1.0.6

Ado::Sessions versions through 0.935 for Perl generates insecure session ids

• BEROV Ado::Sessions
• Weak cryptography or TLS
• CWE-340