Weak cryptography or TLS.

ePA 3.x Integration: TLS Certificate Verification Universally Disabled

• fbeta-GmbH ePA3-Service-OpenSource
• Weak cryptography or TLS

ePA 3.x Integration: VAU Server Authentication Bypass via Circular Certificate Trust

• fbeta-GmbH ePA3-Service-OpenSource
• Weak cryptography or TLS

RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

• Weak cryptography or TLS

<5.33.0 · fixed in 5.33.0

`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

• Python Software Foundation CPython
• Weak cryptography or TLS
• Hard-coded credentials

Mastodon: Unwanted deactivation of SSL/TLS certificate verification

• mastodon
• Weak cryptography or TLS

An issue was discovered in openHiTLS 0.2.0 through 0.3.2.

• Weak cryptography or TLS

Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20.

• Weak cryptography or TLS

http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

• Weak cryptography or TLS

>=6.0.0.0, <6.50.0.0 || >=5.0.0.0, <5.42.0.0 || <=4.48.2.0 · fixed in 6.50.0.0, 5.42.0.0

atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)

• Weak cryptography or TLS
• CWE-494

<1.1.0 · fixed in 1.1.0

Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

• Red Hat multicluster engine for Kubernetes 2.10
• Red Hat multicluster engine for Kubernetes 2.11
• Weak cryptography or TLS

uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

• Command injection
• Weak cryptography or TLS

>=0.27.4, <0.28.9 · fixed in 0.28.9

Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

• Path traversal
• Information disclosure

<3.3.0 · fixed in 3.3.0

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modi...

• Weak cryptography or TLS

<1.4.0 · fixed in 1.4.0

openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable ...

• Weak cryptography or TLS

<1.4.0 · fixed in 1.4.0

openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been forma...

• Weak cryptography or TLS

<1.4.0 · fixed in 1.4.0

openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the...

• Weak cryptography or TLS

<1.4.0 · fixed in 1.4.0

openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and ...

• Weak cryptography or TLS

<1.4.6 · fixed in 1.4.6

pkp pkp-lib API Key Generation APIProfileForm.php setData entropy

• pkp-lib
• Weak cryptography or TLS
• CWE-331

mangroup dtale Flask Session Cookie app.py build_secret_key random values

• mangroup dtale
• Weak cryptography or TLS
• CWE-310

@fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key

• @fastify/jwt
• Weak cryptography or TLS

TRENDnet TEW-WLC100 IKE Phase 1 Aggressive Mode racoon.conf missing encryption

• TRENDnet TEW-WLC100
• Weak cryptography or TLS
• CWE-310

Quay: stripe webhook accepts forged events without signature verification in quay

• Red Hat OpenShift Update Service
• Red Hat Quay 3
• Weak cryptography or TLS

Improper certificate validation in OpenVPN

• OpenVPN
• Weak cryptography or TLS
• CWE-115

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability

• PAX Technology Q80
• Weak cryptography or TLS

TL280

• Johnson Controls TL280
• Weak cryptography or TLS

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

• Weak cryptography or TLS

<0.40.0 · fixed in 0.40.0

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

• Weak cryptography or TLS

<0.40.0 · fixed in 0.40.0

Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy

• Tenda CH7
• Tenda CH7G
• Weak cryptography or TLS
• CWE-331

rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode

• rsync
• Weak cryptography or TLS

WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability

• miniOrange Headless Single Sign On
• Weak cryptography or TLS

Authentication Bypass

• Zohocorp ManageEngine Password Manager Pro
• Zohocorp ManageEngine PAM360
• Weak cryptography or TLS

Timing side-channel in RSA PKCS#1 v1.5 decryption in ocrypto

• Oberon microsystems AG ocrypto
• Weak cryptography or TLS
• CWE-208

Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA Crypto

• Oberon microsystems AG Oberon PSA Crypto
• Weak cryptography or TLS
• CWE-208

GlobalProtect App: Improper Certificate Validation Bypass Vulnerability

• Palo Alto Networks GlobalProtect App
• Weak cryptography or TLS

Integration credential holders may impersonate users in JFrog Access

• jfrog artifactory
• Weak cryptography or TLS

Potential improper SAML signature verification in JFrog Artifactory

• jfrog artifactory
• Weak cryptography or TLS

In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are skipped.

• Weak cryptography or TLS

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details.

• Weak cryptography or TLS

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are skipped.

• Weak cryptography or TLS

Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

• Apache Software Foundation Apache HttpComponents Client
• Weak cryptography or TLS

Improper certificate validation in SonicWall GMS

• SonicWall GMS
• Weak cryptography or TLS

Active Directory Security Feature Bypass Vulnerability

• Microsoft Windows 11 version 23H2
• Microsoft Windows 11 Version 24H2
• Weak cryptography or TLS

Windows Schannel Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Weak cryptography or TLS

CAI Content Credentials | Improper Certificate Validation (CWE-295)

• Adobe Content Credentials Rust SDK
• Adobe Content Credentials Command-Line Tool
• Weak cryptography or TLS

ColdFusion | Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

• Adobe ColdFusion 2025
• Adobe ColdFusion 2023
• Weak cryptography or TLS

Command injection vulnerability in certain NETGEAR Nighthawk and Orbi routers

• NETGEAR BE9300
• NETGEAR MR60
• Weak cryptography or TLS

Improper certificate validation in Ivanti Endpoint Manager

• Ivanti Endpoint Manager
• Weak cryptography or TLS

Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions

• Red Hat JBoss Enterprise Application Platform 7.4.25
• Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
• Weak cryptography or TLS

Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery

• Red Hat JBoss Enterprise Application Platform 7.4.25
• Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
• Weak cryptography or TLS

Picketlink-federation: auth bypass in picketlink saml unsolicited-response

• Red Hat JBoss Enterprise Application Platform 7.4.25
• Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
• Weak cryptography or TLS

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

• SAP_SE SAP Business AI Platform (Approuter)
• Weak cryptography or TLS

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

• SAP_SE SAP Business AI Platform (Approuter)
• Weak cryptography or TLS

Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials

• Red Hat OpenShift AI 2.25
• Red Hat OpenShift AI 3.3
• Weak cryptography or TLS

Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.

• Pegasystems Pega Infinity
• Weak cryptography or TLS

Signature validation vulnerability affecting DigiDoc applications

• Estonian Information System Authority (RIA) libdigidocpp
• Estonian Information System Authority (RIA) DigiDoc4
• Weak cryptography or TLS
• CWE-754

systemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path

• systemd-homed
• Privilege escalation
• Weak cryptography or TLS

Apache Ranger: Clients accept TLS certificates issued for other hostnames

• Apache Software Foundation Apache Ranger
• Weak cryptography or TLS

Improper certificate validation in ECOVACS ROBOTICS Android App "ECOVACS PRO" and others

• ECOVACS ROBOTICS Android App "ECOVACS PRO"
• ECOVACS ROBOTICS iOS App "ECOVACS PRO"
• Weak cryptography or TLS

Broken or risky cryptographic algorithm in ECOVACS ROBOTICS DEEBOT PRO M1 and others

• ECOVACS ROBOTICS DEEBOT PRO M1
• ECOVACS ROBOTICS DEEBOT PRO K1VAC
• Weak cryptography or TLS

Improper certificate validation in ECOVACS ROBOTICS DEEBOT PRO M1 and others

• ECOVACS ROBOTICS DEEBOT PRO M1
• ECOVACS ROBOTICS DEEBOT PRO K1VAC
• Weak cryptography or TLS