Weak cryptography or TLS.

CoreWCF: WS-Security signature substitution via document-wide Signature lookup

• Weak cryptography or TLS

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

• Weak cryptography or TLS
• CWE-636

<7.12.1 · fixed in 7.12.1

Weak random number generator in JetBrains Hub

• JetBrains Hub
• Weak cryptography or TLS

Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Cleartext Transmission of Sensitive Information

• Apollo Pharmacy Blood Glucose Monitoring System (Model No. APG-01 BT)
• Weak cryptography or TLS

PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption

• Weak cryptography or TLS
• CWE-353

<=4.1.6 · no fixed version yet

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely

• HAYAJO Mojolicious::Sessions::Storable
• Weak cryptography or TLS
• CWE-340

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

• Weak cryptography or TLS

>=7.23.0, <7.28.0 || >=8.0.0, <8.5.0 · fixed in 7.28.0, 8.5.0

PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

• Weak cryptography or TLS
• CWE-345

<4.6.59 · fixed in 4.6.59

PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

• Authentication bypass
• Weak cryptography or TLS

>=4.6.56, <4.6.59 · fixed in 4.6.59

Broken or risky cryptographic algorithm in Dell PowerFlex

• Dell PowerFlex
• Weak cryptography or TLS

Improper certificate validation in Dell PowerFlex Manager

• Dell PowerFlex Manager
• Weak cryptography or TLS

Improper certificate validation in Devolutions Remote Desktop Manager

• Devolutions Remote Desktop Manager
• Weak cryptography or TLS

Broken or risky cryptographic algorithm in Canon Inc. EOS Network Setting Tool for Windows and others

• Canon Inc. EOS Network Setting Tool for Windows
• Canon Inc. EOS Network Setting Tool for macOS
• Weak cryptography or TLS

Improper certificate validation in Canon Inc. EOS Network Setting Tool for Windows and others

• Canon Inc. EOS Network Setting Tool for Windows
• Canon Inc. EOS Network Setting Tool for macOS
• Weak cryptography or TLS

Improper certificate validation in Canon Inc. EOS Network Setting Tool for Windows and others

• Canon Inc. EOS Network Setting Tool for Windows
• Canon Inc. EOS Network Setting Tool for macOS
• Weak cryptography or TLS

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce

• BIAFRA Dancer2::Plugin::Auth::OAuth
• Weak cryptography or TLS

Netty: Wrapping plain trust manager silently disables hostname verification

• Weak cryptography or TLS

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty: QUIC stateless reset token material exposed through header-visible connection IDs

• Information disclosure
• Weak cryptography or TLS

>=4.2.0.Final, <4.2.15.Final · fixed in 4.2.15.Final

WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability

• ThemeGrill Masteriyo - LMS
• Weak cryptography or TLS

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

• Weak cryptography or TLS

<3.14.1 · fixed in 3.14.1

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

• Authentication bypass
• Weak cryptography or TLS

<2.13.0 · fixed in 2.13.0

PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys

• Weak cryptography or TLS

>=2.9.0, <2.13.0 · fixed in 2.13.0

Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

• Weak cryptography or TLS

<8.0.8 · fixed in 8.0.8

Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade

• Weak cryptography or TLS
• CWE-757

>=7.2.0, <7.4.13 || >=8.0.0, <8.0.13 · fixed in 7.4.13, 8.0.13

@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

• Weak cryptography or TLS
• CWE-345

<=19.2.25 || >=20.0.0-next.0, <20.3.25 || >=21.0.0-next.0, <21.2.17 || >=22.0.0-next.0, <22.0.1 · fixed in 20.3.25, 21.2.17, 22.0.1

In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate provided by the client (when doing client authentication), which allows impersonation with certificate…

• Weak cryptography or TLS

In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impersonation with certificates that are not meant for server aut…

• Weak cryptography or TLS

SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

• SimpleHelp
• Weak cryptography or TLS

Aqara unauthenticated AES oracle

• Aqara IAM/SSO Gateway
• Weak cryptography or TLS

Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations

• ARODLAND Crypt::PBKDF2
• Weak cryptography or TLS

Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts

• ARODLAND Crypt::PBKDF2
• Weak cryptography or TLS

Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

• Weak cryptography or TLS

>=4.2.0, <4.2.2 || <4.1.7 · fixed in 4.2.2, 4.1.7

Idira Vendor PAM - Self-Hosted Connector: Potential Security Bypass due to Incomplete TLS Certificate Validation

• CyberArk Software, a Palo Alto Networks Company Vendor PAM
• Weak cryptography or TLS

UAA accepts SAML Encrypted Assertions authentication bypass

• Cloud Foundry UAA
• Cloud Foundry CF Deployment
• Weak cryptography or TLS

Idira Endpoint Privilege Manager Agent: Security Control and Cryptographic Validation Bypass in Internal Agent Validation Processes

• CyberArk Software, a Palo Alto Networks Company Idira Endpoint Privilege Manager
• Weak cryptography or TLS

@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

• Information disclosure
• Weak cryptography or TLS

<18.1.2 · fixed in 18.1.2

Spring Web Services: Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default

• Weak cryptography or TLS

>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8 · fixed in 5.0.2, 4.1.4

Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification

• Weak cryptography or TLS

>=4.0.0, <4.0.7 || >=3.5.0, <3.5.15 || >=3.4.0, <=3.4.16 · fixed in 4.0.7, 3.5.15

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc

• davidanderson UpdraftPlus: WP Backup & Migration Plugin
• Weak cryptography or TLS

Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication

• Weak cryptography or TLS

<0.16.0 · fixed in 0.16.0

Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations

• Weak cryptography or TLS

<2.555.3 || >=2.556, <2.568 · fixed in 2.555.3, 2.568

Broken or risky cryptographic algorithm in Lenovo X13 Gen 6 (Type 21RK, 21RL) Laptops (ThinkPad) BIOS and others

• Lenovo X13 Gen 6 (Type 21RK, 21RL) Laptops (ThinkPad) BIOS
• Lenovo X1 Carbon 13th Gen (Type 21NX, 21NY) Laptops (ThinkPad) BIOS
• Weak cryptography or TLS

Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule

• nationalsecurityagency ghidra
• Weak cryptography or TLS

Improper Certificate Validation in S2OPC

• Systerel S2OPC
• Weak cryptography or TLS

Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads

• Weak cryptography or TLS

>=7.0.0, <7.0.6 || >=6.5.0, <6.5.11 || >=6.4.0, <=6.4.16 || >=6.3.0, <=6.3.16 || >=5.8.0, <=5.8.25 || <=5.7.23 · fixed in 7.0.6, 6.5.11

Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean

• Weak cryptography or TLS

>=4.0.0, <4.0.4 || >=3.2.0, <3.2.11 || >=3.1.0, <=3.1.15 || <=2.4.17 · fixed in 4.0.4, 3.2.11

Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue

• Weak cryptography or TLS

>=4.0.0, <4.0.4 || >=3.2.0, <3.2.11 || >=3.1.0, <=3.1.15 || <=2.4.17 · fixed in 4.0.4, 3.2.11

Client side encryption fails to encrypt values in a $vectorSearch

• MongoDB Server
• Weak cryptography or TLS

Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate

• OpenSSL
• Weak cryptography or TLS

Spring Framework Predictable Session ID in WebSocket Module

• Weak cryptography or TLS

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.27 || <=5.3.48 · fixed in 7.0.8, 6.2.19

XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform

• SAP_SE SAP NetWeaver AS ABAP and ABAP Platform
• Weak cryptography or TLS

A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.

• Weak cryptography or TLS

Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

• Weak cryptography or TLS
• CWE-340

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Certificate Validation Bypass in VPN Site-to-Site Connections Using IKEv1

• checkpoint Quantum Security Gateway
• checkpoint Spark Firewalls
• Weak cryptography or TLS

grepai Uses a Broken or Risky Cryptographic Algorithm

• Weak cryptography or TLS

<=0.35.0 · no fixed version yet

grepai Uses a Broken or Risky Cryptographic Algorithm

• Weak cryptography or TLS

<=0.35.0 · no fixed version yet

haxtheweb/haxcms-php uses insecure method for generating salt

• haxtheweb haxcms-php
• Weak cryptography or TLS

Termix has improper certificate validation in Electron desktop client that enables MITM credential/token theft

• Termix
• Weak cryptography or TLS

claude-mem: The computeObservationContentHash Function is Vulnerable to Hash Collision

• Weak cryptography or TLS

<12.0.0 · fixed in 12.0.0

onnx onnx-mlir Placeholder Node Cache backend.py generate_hash_key weak hash

• onnx-mlir
• Weak cryptography or TLS