Weak cryptography or TLS.

Cleartext transmission of sensitive information in NVIDIA Isaac Launchable

• NVIDIA Isaac Launchable
• Weak cryptography or TLS

FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections.

• Weak cryptography or TLS

Improper Certificate Verification in Szafir SDK

• Krajowa Izba Rozliczeniowa Szafir SDK
• Weak cryptography or TLS
• CWE-393

Sunshine: Authentication bypass via improper client certificate validation

• LizardByte Sunshine
• Authentication bypass
• Weak cryptography or TLS

Improper certificate validation in ivanti Secure Access Client

• ivanti Secure Access Client
• Weak cryptography or TLS

Broken or risky cryptographic algorithm in Dell PowerFlex Manager (Appliance) and others

• Dell PowerFlex Manager (Appliance)
• Dell PowerFlex Manager (Rack)
• Weak cryptography or TLS

Improper certificate validation in Dell PowerFlex Manager (Appliance) and others

• Dell PowerFlex Manager (Appliance)
• Dell PowerFlex Manager (Rack)
• Weak cryptography or TLS

Lack of traffic encryption in STER

• Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy STER
• Weak cryptography or TLS

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

• Weak cryptography or TLS

<0.52.0 · fixed in 0.52.0

ImageMagick: Information Disclosure in PasskeyEncipherImage via AES-CTR nonce reuse

• Weak cryptography or TLS
• CWE-323

<14.12.0 · fixed in 14.12.0

Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in rm/incs/mobile_login.inc.php

• Open ISES Tickets
• Weak cryptography or TLS

Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in incs/login.inc.php

• Open ISES Tickets
• Weak cryptography or TLS

Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in incs/functions.inc.php

• Open ISES Tickets
• Weak cryptography or TLS

Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in ajax/reports.php

• Open ISES Tickets
• Weak cryptography or TLS

Predictable afpd session token

• Netatalk
• Weak cryptography or TLS

Weak cryptography in DHCAST128 UAM

• Netatalk
• Weak cryptography or TLS

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts

• RRWO Crypt::SaltedHash
• Weak cryptography or TLS

Weak password hashing in Mesalvo Meona Client and others

• Mesalvo Meona Client
• Mesalvo Meona Server
• Weak cryptography or TLS

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

• Weak cryptography or TLS

<=0.27.3 · no fixed version yet

libcrux-ml-dsa: Signature Verification on AVX2 Platforms Mishandles Edge Case

• Weak cryptography or TLS

<0.0.9 · fixed in 0.0.9

HAXcms: Private Key Disclosure via Broken HMAC Implementation

• Information disclosure
• Hard-coded credentials

<26.0.0 · fixed in 26.0.0

Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

• Weak cryptography or TLS

<2.6.23 || >=3.0.0-alpha1, <3.0.6 · fixed in 2.6.23, 3.0.6

ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351

• Authentication bypass
• Weak cryptography or TLS

<2.10.3 || >=3.0.0, <3.2.0 · fixed in 2.10.3, 3.2.0

opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash

• opensourcepos Open Source Point of Sale
• Weak cryptography or TLS

Improper certificate validation in Dell Live Optics

• Dell Live Optics
• Weak cryptography or TLS

Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client

• Weak cryptography or TLS

<1.2.2 · fixed in 1.2.2

epa4all-client: TLS Certificate Validation Disabled in Production

• Weak cryptography or TLS

<1.2.2 · fixed in 1.2.2

arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS

• Authentication bypass
• Weak cryptography or TLS

<1.0.1 · fixed in 1.0.1

goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request

• Weak cryptography or TLS
• CWE-322

<2.0.7 · fixed in 2.0.7

LibJWT: Algorithm confusion allows JWT forgery with RSA JWK as empty-key HMAC

• benmcollins libjwt
• Weak cryptography or TLS

Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids

• GUIMARD Apache::Session::Generate::SHA256
• Weak cryptography or TLS
• CWE-340

Improper signature verification in AMD Radeon™ RX 7000 Series Graphics Products

• AMD Radeon™ RX 7000 Series Graphics Products
• Weak cryptography or TLS

slack-go `SecretsVerifier` accepts empty signing secret without precondition

• Authentication bypass
• Weak cryptography or TLS

<0.23.1 · fixed in 0.23.1

electerm's encrypt method not safe enough

• Weak cryptography or TLS
• CWE-329

<3.9.5 · fixed in 3.9.5

HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels.

• HCL AION
• Weak cryptography or TLS

HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations

• HCL AION
• Weak cryptography or TLS

Fleet has a Windows MDM management endpoint authentication bypass

• Weak cryptography or TLS

<4.81.0 · fixed in 4.81.0

TLS hostname verification disabled when using Boring TLS backend

• Weak cryptography or TLS

>=0.10.1, <0.11.22 · fixed in 0.11.22

Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information.

• Weak cryptography or TLS

Cleartext transmission of sensitive information in KDDI CORPORATION あんしんフィルター for au

• KDDI CORPORATION あんしんフィルター for au
• Weak cryptography or TLS

Improper certificate validation in WebPros cPanel and others

• WebPros cPanel
• WebPros WP Squared
• Weak cryptography or TLS

Prisma Access Agent: Improper Certificate Validation Vulnerability

• Palo Alto Networks Prisma Access Agent
• Weak cryptography or TLS

Prisma SD-WAN: Improper Certificate Validation Vulnerability

• Palo Alto Networks Prisma SD-WAN ION
• Weak cryptography or TLS

GlobalProtect App: Certificate Validation Bypass Vulnerabilities

• Palo Alto Networks GlobalProtect App
• Weak cryptography or TLS

PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks PAN-OS
• Weak cryptography or TLS

Claude Desktop: SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions

• anthropics claude-code
• Weak cryptography or TLS
• CWE-322

aria2c Improper Certificate Validation

• aria2_project aria2c
• Weak cryptography or TLS

Ecommerce Systempay 1.0 Production Key Brute Force

• Paiement Ecommerce Systempay
• Weak cryptography or TLS

connection reuse ignores TLS requirement

• curl
• Weak cryptography or TLS

OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover

• Authentication bypass
• Weak cryptography or TLS

<2.0.4 · fixed in 2.0.4

Security feature bypass vulnerability in Azure Key Vault Keys library for Java

• Authentication bypass
• Weak cryptography or TLS

<4.10.6 · fixed in 4.10.6

Insecure generation of SAT access credentials in Ingecon EMS Board

• Ingeteam Ingecon Sun EMS Board
• Weak cryptography or TLS

Improper certificate validation in EPG, Inc. "Kura Sushi Official App" for Android and others

• EPG, Inc. "Kura Sushi Official App" for Android
• EPG, Inc. "Kura Sushi Official App" for iOS
• Weak cryptography or TLS

Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys

• BIGFOOT Amazon::Credentials
• Weak cryptography or TLS

Zen Browser MAR updater ships with signature verification removed — unsigned updates accepted

• zen-browser desktop
• Weak cryptography or TLS

Meari weak XOR obfuscation

• com.meari.sdk
• Weak cryptography or TLS

Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

• Weak cryptography or TLS

>=13.4.6, <15.5.16 || >=16.0.0, <16.2.5 · fixed in 15.5.16, 16.2.5

WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely

• ASPEER WebDyne::Session
• Weak cryptography or TLS
• CWE-340

Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids

• RRWO Catalyst::Plugin::Statsd
• Weak cryptography or TLS

Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses

• RRWO Plack::Middleware::Statsd
• Weak cryptography or TLS