Weak cryptography or TLS.

Hardcoded Cryptographic Keys and Weak IV Generation in linqi

• linqi
• Hard-coded credentials
• Weak cryptography or TLS

AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle

• Weak cryptography or TLS
• Race condition

<0.107.75 · fixed in 0.107.75

milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery

• Weak cryptography or TLS

<0.10.3-0.20260602041816-3d932f1c3e06 · fixed in 0.10.3-0.20260602041816-3d932f1c3e06

OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake

• Weak cryptography or TLS

>=1.0.0, <=17.3.0 · no fixed version yet

LMCache: 16-bit multimodal hash collision can poison KV cache entries

• Weak cryptography or TLS

<=0.4.6 · no fixed version yet

kas's late signature validation may allow unnoticed repository manipulations

• Weak cryptography or TLS

>=4.8, <5.3 · fixed in 5.3

GPTCache: File and image cache keys collide because BufferedReader.peek() only reads the buffered prefix

• Weak cryptography or TLS

<=0.1.44 · no fixed version yet

ms-swift: Image Cache Hash Collision via Missing Dimension Metadata

• Weak cryptography or TLS

<=4.2.0 · no fixed version yet

A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation...

• Weak cryptography or TLS

<1.53.1 · fixed in 1.53.1

A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component Dataset Digest Computation. This mani...

• Weak cryptography or TLS

<3.10.1 · fixed in 3.10.1

Cleartext Transmission of Credentials Vulnerability in GX Earth ONT Models

• GX INDIA GX Earth 2022
• GX INDIA GX Earth 1010
• Weak cryptography or TLS

PaddlePaddle FastDeploy MultimodalHasher hasher.py hash_features weak hash

• PaddlePaddle FastDeploy
• Weak cryptography or TLS

Permissive TrustAllCerts TLS Verification

• Acer Connect M6E 5G Portable WiFi Router
• Weak cryptography or TLS

Weak random number generator in Cloud Foundry Foundation windows-utilities-release

• Cloud Foundry Foundation windows-utilities-release
• Weak cryptography or TLS

Improper certificate validation in Cloud Foundry Foundation BOSH

• Cloud Foundry Foundation BOSH
• Weak cryptography or TLS

Weak encryption in Cloud Foundry Foundation BOSH

• Cloud Foundry Foundation BOSH
• Weak cryptography or TLS

A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Performing a manipulation results in use of ...

• Weak cryptography or TLS

<=6.14.0 · no fixed version yet

GNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password, possibly allowing attackers to obtain root credentials and privileges via a bruteforce attack.

• Weak cryptography or TLS

mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption

• Weak cryptography or TLS

<=1.12.0rc3 · no fixed version yet

CVE-2026-8874

• Securly Chrome Extension
• Weak cryptography or TLS

OP-TEE vulnerable to ECDH private key recovery

• OP-TEE optee_os
• Weak cryptography or TLS

Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake

• Weak cryptography or TLS

>=5.2, <5.2.15 || >=6.0, <6.0.6 · fixed in 5.2.15, 6.0.6

Django: signed cookies are vulnerable to salt namespace collisions

• Weak cryptography or TLS

<5.2.15 || >=6.0.0, <6.0.6 · fixed in 5.2.15, 6.0.6

Cleartext transmission of sensitive information in Synology Note Station Client

• Synology Note Station Client
• Weak cryptography or TLS

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding.

• Weak cryptography or TLS
• CWE-523

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP.

• Weak cryptography or TLS
• CWE-341

QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php

• QloApps
• Weak cryptography or TLS

HTTPS Fallback to HTTP in Graph Explorer

• AWS Graph Explorer
• Weak cryptography or TLS

CodexBar < 0.32.0 Session Cookie Exposure via HTTP Redirect

• steipete CodexBar
• Weak cryptography or TLS

kas checks out SHA-like git branches as valid commits

• Weak cryptography or TLS

<5.3 · fixed in 5.3

Apache Airflow has no certificate validation on SMTP STARTTLS connections

• Weak cryptography or TLS

>=2.0.0, <3.2.2 · fixed in 3.2.2

Apache Directory LDAP API lacks server certificate verification for LDAP hostnames

• Weak cryptography or TLS

>=2.0.0, <2.1.8 · fixed in 2.1.8

Missing authentication and clear‑text data transmission affecting Orca heat pumps

• Orca Energy Orca heat pump
• Orca Energy Orca user portal
• Cross-site scripting (XSS)
• Authentication bypass

stigmem-node's federation peer registration lacked explicit out-of-band approval

• Weak cryptography or TLS
• CWE-345

<0.9.0a2 · fixed in 0.9.0a2

stigmem-node's federation insecure transport settings may allow non-loopback cleartext federation

• Weak cryptography or TLS
• CWE-489

<0.9.0a2 · fixed in 0.9.0a2

Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification

• Authentication bypass
• Weak cryptography or TLS

>=6.4.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 6.4.40, 7.4.12, 8.0.12

authentik's XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

• Authentication bypass
• Weak cryptography or TLS

<0.0.0-20260528144335-a370d76d23c7 · fixed in 0.0.0-20260528144335-a370d76d23c7

AgenticMail API/storage and outbound relay hardening fixes

• SQL injection
• Broken access control

<0.9.32 · fixed in 0.9.32

MacGregor Voyage Data Recorder (VDR) G4e Use of Password Hash With Insufficient Computational Effort

• Danelec MacGregor Voyage Data Recorder (VDR) G4e
• Weak cryptography or TLS

Indian Scout Bobber 2025 WCM-to-ECM weak authentication

• Indian Motorcycle Scout Bobber + Tech
• Weak cryptography or TLS
• Hard-coded credentials

Indian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchange

• Indian Motorcycle Scout Bobber + Tech
• Authentication bypass
• Weak cryptography or TLS

Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

• Authentication bypass
• Weak cryptography or TLS

>=7.2.0, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 7.4.12, 8.0.12

Bluetooth Communication Uses Unencrypted Transmission During Initial Setup on TP-Link's Tapo L535E, P300 and D100C

• TP-Link Systems Inc. Tapo L535E v1.0, v3.0
• TP-Link Systems Inc. Tapo P300 v1.0
• Weak cryptography or TLS

ex_aws_sns SigningCertURL not validated in verify_message/1

• Weak cryptography or TLS

>=2.0.1, <2.3.5 · fixed in 2.3.5

Keycloak has an Improper Verification of Cryptographic Signature issue

• Weak cryptography or TLS

<=26.6.4 · no fixed version yet

Deno's TLS retry copies stale upgrade hook, risking plaintext traffic

• Weak cryptography or TLS

>=2.0.0, <2.7.8 · fixed in 2.7.8

WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.php

• LabRedesCefetRJ WeGIA
• Weak cryptography or TLS
• CWE-759

nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification

• Erlang OTP
• Weak cryptography or TLS

OCSP responder certificate validity period not checked in public_key

• Erlang OTP
• Weak cryptography or TLS
• CWE-672

Non-CA certificate accepted as intermediate issuer in public_key path validation

• Erlang OTP
• Weak cryptography or TLS
• CWE-296

Cleartext transmission of sensitive information in Synology Surveillance Station

• Synology Surveillance Station
• Weak cryptography or TLS

Insufficient Verification of Data Authenticity

• Phoenix Contact AXC F 1152
• Phoenix Contact AXC F 1252
• Weak cryptography or TLS

Northern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass.

• Weak cryptography or TLS

Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

• Weak cryptography or TLS
• CWE-180

<1.9.11 || >=1.10.0, <1.10.10 || >=2.0.0, <2.0.18 || >=2.1.0, <2.1.14 || >=2.2.0, <2.2.3 · fixed in 1.9.11, 1.10.10, 2.0.18, 2.1.14, 2.2.3

netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures

• Weak cryptography or TLS

<0.0.21.Final · fixed in 0.0.21.Final

Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available

• MIK Crypt::ScryptKDF
• Weak cryptography or TLS

Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Weak cryptography or TLS

Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Weak cryptography or TLS

MaxKB: Unsalted MD5 Password Hashing

• 1Panel-dev MaxKB
• Weak cryptography or TLS

Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links

• Joomla! Project Joomla! CMS
• Weak cryptography or TLS