Weak cryptography or TLS.

Cleartext transmission of sensitive information in EZVIZ APP

• EZVIZ APP
• Weak cryptography or TLS

Vert.x has a DoS via unbounded server-side SNI SslContext cache growth

• Weak cryptography or TLS
• Denial of service

>=4.3.4, <=4.3.8 || >=4.4.0, <=4.4.9 || >=4.5.0, <4.5.27 || >=5.0.0, <5.0.12 · fixed in 4.5.27, 5.0.12

epa4all-client has a VAU Signature bypass

• Weak cryptography or TLS

<1.2.1 · fixed in 1.2.1

gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits

• Weak cryptography or TLS

<0.16.0 · fixed in 0.16.0

SolidCAM-GPPL-IDE: Path traversal in `inc` directive enables file probing and NTLM-hash leak

• anzory SolidCAM-GPPL-IDE
• Path traversal
• Information disclosure

Plunk: SNS webhook forgery

• plunk
• Weak cryptography or TLS

OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured

• Weak cryptography or TLS

<1.1.0 · fixed in 1.1.0

Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output

• Weak cryptography or TLS
• CWE-354

<4.4.1 · fixed in 4.4.1

bitcoinj has a ScriptExecution P2PKH/P2WPKH Verification Bypass

• Weak cryptography or TLS

>=0.15, <0.17.1 · fixed in 0.17.1

Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts

• RSAVAGE Crypt::PasswdMD5
• Weak cryptography or TLS

ex_webrtc client-role handshake is missing DTLS peer fingerprint validation

• Weak cryptography or TLS

<0.15.1 || >=0.16.0, <0.16.1 · fixed in 0.15.1, 0.16.1

MAXHUB Pivot Client Application Use of a Broken or Risky Cryptographic Algorithm

• MAXHUB Pivot client application
• Weak cryptography or TLS

Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery

• Weak cryptography or TLS
• CWE-345

<0.0.0-20260501152247-18b587758667 · fixed in 0.0.0-20260501152247-18b587758667

Zebra's Transparent SIGHASH_SINGLE Handling Diverges from zcashd for Corresponding Outputs

• Weak cryptography or TLS
• CWE-354

<4.4.0 · fixed in 4.4.0

Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer

• Weak cryptography or TLS

<4.4.0 · fixed in 4.4.0

Malicious module proxy can bypass checksum database in cmd/go

• Weak cryptography or TLS

<1.25.10 || >=1.26.0-0, <1.26.3 · fixed in 1.25.10, 1.26.3

GnuTLS backend silently skips certificate chain verification when verify_peer is false

• pjsip pjproject
• Weak cryptography or TLS

Improper certificate validation in Ivanti Endpoint Manager Mobile

• Ivanti Endpoint Manager Mobile
• Weak cryptography or TLS

Improper certificate validation in Ivanti Endpoint Manager Mobile

• Ivanti Endpoint Manager Mobile
• Weak cryptography or TLS

Gnutls: gnutls: security bypass due to incorrect name constraint handling

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Weak cryptography or TLS

RELATE: Predictable Token Generation in auth.py and exam.py

• inducer relate
• Weak cryptography or TLS

CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content

• Weak cryptography or TLS
• CWE-829

<1.22.0 || >=2.0.0, <2.1.0 · fixed in 1.22.0, 2.1.0

OpenSearch has ineffective TLS certificate hostname verification

• Weak cryptography or TLS

>=2.18.0, <2.19.4.0 || >=3.0.0, <3.3.0.0 · fixed in 2.19.4.0, 3.3.0.0

axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

• Weak cryptography or TLS
• CWE-345

<7.0.0 · fixed in 7.0.0

axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

• Weak cryptography or TLS
• CWE-345

<6.0.0 · fixed in 6.0.0

axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

• Weak cryptography or TLS
• CWE-345

<5.7.0 · fixed in 5.7.0

axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

• Weak cryptography or TLS
• CWE-345

<6.7.0 · fixed in 6.7.0

misp-modules has unsafe remote resource fetching in expansion

• Weak cryptography or TLS
• Server-side request forgery (SSRF)

<3.0.8 · fixed in 3.0.8

fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver

• Authentication bypass
• Weak cryptography or TLS

<6.2.4 · fixed in 6.2.4

Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS

• Weak cryptography or TLS

<1.8.0 · fixed in 1.8.0

Lemur: LDAP Authentication Globally Disables TLS Certificate Verification When LDAP_USE_TLS Is Enabled

• Weak cryptography or TLS

<1.9.0 · fixed in 1.9.0

Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ

• Linux kernel
• Weak cryptography or TLS

HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability

• HCL DFXAnalytics
• Weak cryptography or TLS

Paramiko rsakey.py allows the SHA-1 algorithm

• Weak cryptography or TLS

<5.0.0 · fixed in 5.0.0

Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

• Weak cryptography or TLS
• CWE-331

<20.18.0 · fixed in 20.18.0

Sandboxie-Plus EditPassword hash entropy reduced from 160 bits to 80 bits due to incorrect nibble extraction

• Sandboxie
• Weak cryptography or TLS

awslabs/tough Delegated Roles have a Signature Threshold Bypass

• Weak cryptography or TLS

<0.22.0 · fixed in 0.22.0

Langchain-Chatchat Uses Insufficiently Random Values

• Weak cryptography or TLS
• CWE-310

<=0.3.1.3 · no fixed version yet

Langchain-Chatchat Uses a Broken or Risky Cryptographic Algorithm

• Weak cryptography or TLS

<=0.3.1.3 · no fixed version yet

Improper certificate validation in multiple RouterOS services

• Mikrotik RouterOS
• Weak cryptography or TLS

Apache Thrift has an Improper Validation of Certificate with Host Mismatch Vulnerability

• Weak cryptography or TLS

<0.23.0 · fixed in 0.23.0

pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

• Weak cryptography or TLS
• Authentication bypass

<0.5.0b3.dev100 · fixed in 0.5.0b3.dev100

Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots

• Authentication bypass
• Weak cryptography or TLS

<7.0.0 · fixed in 7.0.0

Dolibarr has Insufficient Verification of Data Authenticity

• Weak cryptography or TLS
• CWE-345

<=15.0.3 · no fixed version yet

TRENDnet TEW-821DAP Firmware Update ssi cleartext transmission

• TRENDnet TEW-821DAP
• Weak cryptography or TLS
• CWE-310

apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider

• Weak cryptography or TLS

>=2.0.0, <3.0.0 · fixed in 3.0.0

Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely

• BIGPRESH Dancer::Session::Abstract
• Weak cryptography or TLS
• CWE-340

Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests

• Weak cryptography or TLS

<5.0.9 · fixed in 5.0.9

CKAN has no certificate validation on STMP connection

• Weak cryptography or TLS

<2.10.10 || >=2.11.0, <2.11.5 · fixed in 2.10.10, 2.11.5

Sensitive Data Exposure Vulnerability in e-Sushrut HMIS

• CDAC-Noida e-Sushrut, Hospital Management Information System (HMIS)
• Weak cryptography or TLS

Elastic Package Registry has Improper Verification of Cryptographic Signature

• Weak cryptography or TLS

<1.38.0 · fixed in 1.38.0

Netmaker does not verify JWT signatures for host tokens

• Weak cryptography or TLS

<1.5.0 · fixed in 1.5.0

Apache Thrift has an issue with Java TSSLTransportFactory hostname verification

• Weak cryptography or TLS

<0.23.0 · fixed in 0.23.0

Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App

• DeskTime Time Tracking App
• Weak cryptography or TLS
• CWE-296

Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification

• Weak cryptography or TLS

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32 · fixed in 4.0.6, 3.5.14

Spring Boot's random value property source uses a weak PRNG unsuitable for secrets

• Weak cryptography or TLS

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32 · fixed in 4.0.6, 3.5.14

Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker

• Weak cryptography or TLS

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 · fixed in 4.0.6, 3.5.14

Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.

• Weak cryptography or TLS

>=4.0.0, <4.0.6 · fixed in 4.0.6

Apache Storm Prometheus Reporter vulnerable to Improper Certificate Validation via Global SSL Context Downgrade

• Weak cryptography or TLS

>=2.6.3, <2.8.7 · fixed in 2.8.7

SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG

• SmarterTools Inc. SmarterMail
• Weak cryptography or TLS