Weak cryptography or TLS.

TS4500 CLI tool addresses security vulnerability

• IBM TS4500 CLI tool
• Weak cryptography or TLS

Insufficient Encryption Level in CasfID Servicios Tecnológicos NFC Wristbands

• CasfID Servicios Tecnológicos NFC Wristbands
• Weak cryptography or TLS

Cleartext transmission of sensitive information in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple tvOS
• Weak cryptography or TLS

Potential privilege escalation to JFrog administrator privileges

• jfrog artifactory
• Weak cryptography or TLS

Apache Wicket: leaked and missing CSP headers

• Apache Software Foundation Apache Wicket
• Weak cryptography or TLS
• CWE-693

Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit

• Weak cryptography or TLS

<0.24.0 · fixed in 0.24.0

Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass

• Apache Software Foundation Apache Thrift
• Weak cryptography or TLS

Apache Thrift: c_glib TLS Client Missing Hostname Verification

• Apache Software Foundation Apache Thrift
• Weak cryptography or TLS

SSH Enablement Signature Verification Bypass

• Lenze c430
• Lenze c520
• Weak cryptography or TLS

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

• Weak cryptography or TLS

<0.5.0 · fixed in 0.5.0

epa4all Security Incident: Implement keystore based on Telematik TSL, implement hostname check and certificate check for lib-vau

• med-united epa4all
• Weak cryptography or TLS

TLS Certificate Verification Disabled on CXF Transport Clients in epa4all

• med-united epa4all
• Weak cryptography or TLS

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

• Weak cryptography or TLS
• CWE-682

>=1.175.0-devpreview, <=1.204.0-devpreview · no fixed version yet

Improper Validation of Certificate in CAS Client

• Java Apereo CAS Client
• Apereo Jasig CAS Client
• Weak cryptography or TLS

Inadequate Encryption Strength in Panduit IntraVUE by Pronetiqs

• Pronetiqs Panduit Intravue
• Weak cryptography or TLS

RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation

• PowerDNS Recursor
• Weak cryptography or TLS
• CWE-345

Wildcard CNAME proof validation bypass

• PowerDNS Recursor
• Weak cryptography or TLS

Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

• Weak cryptography or TLS

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension

• regularlabs.com IP Login extension for Joomla
• Weak cryptography or TLS

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify

• RITOU OIDC::Lite
• Weak cryptography or TLS

Librest: weak random number generation in pkce implementation

• GNOME librest
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Incorrect acceptance of NSEC3 records

• ISC BIND 9
• Weak cryptography or TLS

Open redirect in Oracle Corporation Oracle WebCenter Content

• Oracle Corporation Oracle WebCenter Content
• Weak cryptography or TLS
• Cross-site request forgery (CSRF)

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

• Weak cryptography or TLS

<1.27.0 · fixed in 1.27.0

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

• Weak cryptography or TLS

>=1.22.0, <1.26.2 · fixed in 1.26.2

HCL MyCloud was affected with SSL/TLS Protocol Affected with LUCKY13 Vulnerability.

• HCLSoftware MyCloud
• Weak cryptography or TLS

Sensitive Data Exposure

• Zohocorp ManageEngine Endpoint Central
• Weak cryptography or TLS

Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability

• Weak cryptography or TLS
• CWE-345

>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.4, 9.0.18, 10.0.10

Apache MINA SSHD: SSH certificate options lack validations

• Apache Software Foundation Apache MINA SSHD
• Weak cryptography or TLS

ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG

• Extreme Networks Switch Engine (EXOS)
• Weak cryptography or TLS

Weak password hashing in Windu CMS

• JCD Windu CMS
• Weak cryptography or TLS

Duplicate Advisory: SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation

• Weak cryptography or TLS

* · no fixed version yet

Network-AI before 5.13.4 Cryptographic Signature Verification Bypass

• Jovancoding Network-AI
• Weak cryptography or TLS

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

• Weak cryptography or TLS
• CWE-340

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts

• DRSTEVE Crypt::Password
• Weak cryptography or TLS

Duplicate Advisory: urwid: Insecure PRNG and Information Exposure in Web Display Backend

• Weak cryptography or TLS

<4.0.6 · fixed in 4.0.6

Insecure PRNG and Information Exposure in urwid Web Display Backend

• urwid
• Weak cryptography or TLS

Weak encryption in HCL Software Aftermarket EPC

• HCL Software Aftermarket EPC
• Weak cryptography or TLS

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets

• BURAK GD::SecurityImage
• Weak cryptography or TLS
• CWE-804

Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled

• GARU Dancer::Plugin::Auth::Google
• Weak cryptography or TLS

kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

• Weak cryptography or TLS

<=1.8.1 · no fixed version yet

WireGuard Easy Weak Token Generation Information Disclosure via OTL Route

• wg-easy
• Weak cryptography or TLS
• Authentication bypass

kumactl connects to control plane without verifying TLS certificate when no CA is configured

• Weak cryptography or TLS

<=1.8.1 · no fixed version yet

BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them

• bigbluebutton
• Weak cryptography or TLS

Janssen Project: JWE Request Object Signature Verification Bypass in jans-auth-server

• jans
• Weak cryptography or TLS

moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint

• microsoft o365-moodle
• Weak cryptography or TLS

HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1.

• HCL Software DFXAnalytics
• Weak cryptography or TLS

HCL DFXServer is affected by an Unencrypted Communication vulnerability.

• HCLSoftware DFXServer
• Weak cryptography or TLS

Snowflake Connector for Python improperly verifies TLS hostnames

• Weak cryptography or TLS

<3.18.1 || >=4.0.0, <4.7.1 · fixed in 3.18.1, 4.7.1

SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion

• cyberlord92 SAML Single Sign On – SSO Login
• Weak cryptography or TLS

DataEase: Unauthorized Command Execution Vulnerability

• dataease
• Weak cryptography or TLS

Cisco RoomOS Security Hardening Release - Missing Encryption Vulnerabilities

• Cisco RoomOS Software
• Weak cryptography or TLS

Improper certificate validation in ASUS Router

• ASUS Router
• Weak cryptography or TLS
• CWE-354

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

• Weak cryptography or TLS

Weak Password Hashing Mechanism in TP-Link Deco M5

• TP-Link Systems Inc. Deco M5 Deco M5 V1
• Weak cryptography or TLS

Windows Cryptographic Services Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• Weak cryptography or TLS

Azure Connected Machine Agent Elevation of Privilege Vulnerability

• Microsoft Azure Connected Machine Agent
• Weak cryptography or TLS

Active Directory Domain Services Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Weak cryptography or TLS

Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Weak cryptography or TLS

Improper certificate validation in Fortinet FortiClientEMS

• Fortinet FortiClientEMS
• Weak cryptography or TLS