Weak cryptography or TLS.

Tenable Agent Path Traversal Leading to Remote Code Execution

• tenable_agent
• Path traversal
• Weak cryptography or TLS

Improper signature verification in Siemens Opcenter X

• Siemens Opcenter X
• Weak cryptography or TLS

Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks

• Weak cryptography or TLS
• CWE-299

>=0.2.0, <3.1.2 · fixed in 3.1.2

wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash

• wandb
• Weak cryptography or TLS

Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability

• Lorex 2K Indoor Wi-Fi Security Camera
• Weak cryptography or TLS

DIRAC: Pilot code downloaded over unverified HTTPS connection

• Weak cryptography or TLS

>=6.20.1, <8.0.79 || >=8.1.0a1, <9.0.22 || >=9.1.0, <9.1.10 · fixed in 8.0.79, 9.0.22, 9.1.10

Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key

• rejetto hfs
• Weak cryptography or TLS

Missing firmware validation allows remote code execution

• EVbee DC-80
• Weak cryptography or TLS

Adversary-in-the-Middle (AitM) attack vulnerability in EVbee Service app

• EVbee Service
• Weak cryptography or TLS

cpp-httplib: TLS certificate chain verification bypassed for IP-literal hosts on Mbed TLS and wolfSSL backends

• yhirose cpp-httplib
• Weak cryptography or TLS

Weak password hashing in R-SOFT DMS

• R-SOFT SERWIS DMS
• Weak cryptography or TLS

sigstore-go has a multi-log threshold bypass via single compromised log

• Weak cryptography or TLS
• CWE-345

<1.2.0 · fixed in 1.2.0

YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`

• Weak cryptography or TLS

>=4.6.2, <4.6.6 · fixed in 4.6.6

Prisma Access Agent: Improper Certificate Validation on iOS

• Palo Alto Networks Prisma Access Agent
• Weak cryptography or TLS

CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint

• corvusinfo CorvusPay WooCommerce Payment Gateway
• Weak cryptography or TLS

Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported.

• Information disclosure
• Broken access control

etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation

• etcd
• Weak cryptography or TLS

DoLogin Security <= 4.3 - Unauthenticated Authentication Bypass via Insufficient Randomness via 'dologin' Parameter Weak PRNG Token

• wpdo5ea DoLogin Security
• Weak cryptography or TLS

Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection

• Weak cryptography or TLS
• CWE-204

>=4.9.0, <5.3.5 · fixed in 5.3.5

Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

• Weak cryptography or TLS
• CWE-757

<1.6.11 · fixed in 1.6.11

Authentication Bypass in HAVELSAN's Open Source Project Liman MYS

• HAVELSAN Inc. Liman MYS
• Weak cryptography or TLS

Weak encryption mechanism for User directory

• arcinfo PcVue
• Weak cryptography or TLS

Coder's AI Bridge Proxy skips TLS certificate verification in default configuration

• Weak cryptography or TLS

>=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2 · fixed in 2.32.7, 2.33.8, 2.34.2

GoFiber never set HSTS header in helmet middleware due to incorrect protocol check

• Weak cryptography or TLS

<3.4.0 · fixed in 3.4.0

Improper Certificate Validation

• B&R Industrial Automation GmbH APROL
• Weak cryptography or TLS

langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash

• langchain-ai langgraph
• Weak cryptography or TLS

exo-explore exo Vision Feature Cache vision.py _image_cache_key weak hash

• exo
• Weak cryptography or TLS

zcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random values

• zcaceres markdownify-mcp
• Weak cryptography or TLS
• CWE-310

Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery

• TIMLEGGE Crypt::DSA
• Weak cryptography or TLS

ForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hash

• ForceInjection AI-fundermentals
• Weak cryptography or TLS

SSH improper host validation

• curl
• Weak cryptography or TLS

wrong STARTTLS connection reuse

• curl
• Weak cryptography or TLS

proto-default skips SSH verification

• curl
• Weak cryptography or TLS

Native CA trust persist

• curl
• Weak cryptography or TLS

WatchGuard Firebox Firmware Image Validation Bypass in WatchGuard Fireware OS

• WatchGuard Fireware OS
• Weak cryptography or TLS

IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload

• libreswan
• Weak cryptography or TLS
• Denial of service

IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload

• libreswan
• Weak cryptography or TLS
• Denial of service

Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding

• Weak cryptography or TLS
• CWE-256

>=4.0.0, <4.2.0 · fixed in 4.2.0

Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

• Information disclosure
• Weak cryptography or TLS

<4.2.0 · fixed in 4.2.0

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

• Weak cryptography or TLS

<4.19.3 || >=4.20.0, <4.20.2 || >=5.0.0, <5.0.6 || >=6.0.0, <6.2.1 · fixed in 4.19.3, 4.20.2, 5.0.6, 6.2.1

joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

• Authentication bypass
• Weak cryptography or TLS

<1.6.8 · fixed in 1.6.8

Improper verification of cryptographic signature in CubeSpace CW0057 Reaction Wheel

• CubeSpace CW0057 Reaction Wheel
• Weak cryptography or TLS

Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

• Weak cryptography or TLS

>=1.23.0, <1.33.5 · fixed in 1.33.5

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

• Weak cryptography or TLS
• Server-side request forgery (SSRF)

<=1.2.7 · no fixed version yet

QUIC has Broken TLS verification

• Weak cryptography or TLS

<1.4.4 · fixed in 1.4.4

Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

• Weak cryptography or TLS

<=2.4.0 · no fixed version yet

SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation

• Weak cryptography or TLS

<3.1.0 · fixed in 3.1.0

sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced

• Weak cryptography or TLS

<4.1.1 · fixed in 4.1.1

Connection possible to the Administration portal with a revoked certificate

• Stormshield Network Security
• Weak cryptography or TLS

Improper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperTool

• Cato Networks SDP Client
• Weak cryptography or TLS
• Race condition

Weak password hash protection in Control-M/Entreprise Manager

• BMC Control-M/Enterprise Manager
• Weak cryptography or TLS

CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources

• MARKSTOS CGI::Session::ID::md5
• Weak cryptography or TLS
• CWE-340

UltraVNC MS-Logon II uses 64-bit Diffie-Hellman and seeded libc rand() enabling credential interception

• uvnc UltraVNC
• Weak cryptography or TLS

UltraVNC vncauth.c uses time-seeded libc rand() to generate VNC authentication challenge bytes

• uvnc UltraVNC
• Weak cryptography or TLS

Vulnerabilities found in Watson Data Intelligence

• IBM watsonx.data intelligence
• Weak cryptography or TLS

Cleartext Transmission of Sensitive Information in Watson Data Intelligence

• IBM watsonx.data intelligence
• Weak cryptography or TLS

Weak Cryptographic Key Derivation Exposed All Stored Credentials

• IBM Langflow OSS
• Weak cryptography or TLS

Sigstore Java has a vulnerability with bundle verification of integratedTime

• Weak cryptography or TLS

>=2.0.0, <2.1.0 · fixed in 2.1.0

RabbitMQ has predictable credential obfuscation seed value used in Shovel and Federation plugins

• Weak cryptography or TLS
• CWE-335

>=3.8.0, <3.8.32 || >=3.9.0, <3.9.18 || >=3.10.0, <3.10.2 · fixed in 3.8.32, 3.9.18, 3.10.2

PostgreSQL Anonymizer: Unrestricted function can leak the secret salt

• DALIBO PostgreSQL Anonymizer
• Weak cryptography or TLS