Weak cryptography or TLS.

Improper certificate validation in ECOVACS ROBOTICS DEEBOT PRO M1 and others

• ECOVACS ROBOTICS DEEBOT PRO M1
• ECOVACS ROBOTICS DEEBOT PRO K1VAC
• Weak cryptography or TLS

Missing encryption of sensitive data in Samsung Mobile Smart Switch

• Samsung Mobile Smart Switch
• Weak cryptography or TLS

Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum

• klever-io klever-go
• Weak cryptography or TLS
• CWE-345

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

• Weak cryptography or TLS
• CWE-331

<4.0.0 · fixed in 4.0.0

Root password hash exposure vulnerability in ZTE F689 product

• ZTE F689
• Weak cryptography or TLS

Microsoft 365 Admin Center Elevation of Privilege Vulnerability

• Microsoft 365 Admin Center
• Weak cryptography or TLS

Microsoft Teams Spoofing Vulnerability

• Microsoft Teams
• Weak cryptography or TLS

Improper certificate validation in Dell RVTools

• Dell RVTools
• Weak cryptography or TLS

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

• WSO2 Universal Gateway
• WSO2 Traffic Manager
• Weak cryptography or TLS

Duplicate Advisory: Langflow: Weak Fernet Key via random.seed()

• Weak cryptography or TLS

<=1.10.0 · no fixed version yet

rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect

• Weak cryptography or TLS
• Hard-coded credentials

<1.74.4 · fixed in 1.74.4

rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

• Weak cryptography or TLS
• Hard-coded credentials

<1.75.0 · fixed in 1.75.0

rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys

• Information disclosure
• Weak cryptography or TLS

<1.75.0 · fixed in 1.75.0

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

• IBM Langflow OSS
• Weak cryptography or TLS

Langflow is affected by weaknesses in secret handling and sensitive configuration access

• IBM Langflow OSS
• Weak cryptography or TLS

Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability

• Cisco Catalyst SD-WAN Manager
• Weak cryptography or TLS

IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak…

• IBM Maximo Application Suite
• Weak cryptography or TLS

Improper Validation of Certificate with Host Mismatch in IBM Business Automation Workflow containers

• IBM Business Automation Workflow containers and traditional
• Weak cryptography or TLS

SAML authentication bypass in Progress MarkLogic Server

• Progress Software Corporation MarkLogic Server
• Weak cryptography or TLS

Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• Weak cryptography or TLS

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator

• Lenovo XClarity Orchestrator
• Weak cryptography or TLS

Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.8
• Weak cryptography or TLS

Misskey: JSON-LD signature validation + compaction may lead to improper activity handling

• misskey
• Weak cryptography or TLS

python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

• Weak cryptography or TLS

>=45.0.0, <49.0.0 · fixed in 49.0.0

Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

• emlog
• Weak cryptography or TLS

Improper Certificate Validation in TP-Link Omada Cloud Communications

• TP-Link Systems Inc. Omada Gateways
• TP-Link Systems Inc. Omada Switches
• Weak cryptography or TLS

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check

• TIMLEGGE XML::Sig
• Weak cryptography or TLS

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtr…

• TIMLEGGE Net::SAML2
• Weak cryptography or TLS

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID

• TIMLEGGE XML::Sig
• Weak cryptography or TLS

Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature

• TIMLEGGE Net::SAML2
• Weak cryptography or TLS

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured

• TIMLEGGE Net::SAML2
• Weak cryptography or TLS

HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).

• HCL Software HCL iControl
• Weak cryptography or TLS

eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update

• Latvijas Valsts radio un televīzijas centrs (LVRTC) eParakstītājs 3.0
• Weak cryptography or TLS
• CWE-494

Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

• Weak cryptography or TLS

<1.0.2.7 || >=2.0.0, <2.0.2 || >=2.1.0, <2.1.3 · fixed in 1.0.2.7, 2.0.2, 2.1.3

RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Weak cryptography or TLS

Stapled OCSP response accepted without binding to the checked certificate

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Weak cryptography or TLS

JSSE hostname verifier CN-fallback enabled by default despite documented opt-in

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Weak cryptography or TLS

CMS verifySignatures returns true for SignedData with zero signers

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Weak cryptography or TLS

OpenPGP inline-signature policy failures silently ignored

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-FJA
• Weak cryptography or TLS

BKS keystore accepts legacy version with 16-bit integrity MAC key

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Weak cryptography or TLS

Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation

• Weak cryptography or TLS

>=1.0.0, <2.4.1 · fixed in 2.4.1

FreeRDP before 3.29.0 TLS Certificate EKU Bypass

• FreeRDP
• Weak cryptography or TLS

FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass

• FreeRDP
• Weak cryptography or TLS

FreeRDP before 3.29.0 Improper Certificate Hostname Validation

• FreeRDP
• Weak cryptography or TLS

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP

• RRWO Data::Entropy
• Weak cryptography or TLS
• CWE-353

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

• Weak cryptography or TLS

<7.8.0 · fixed in 7.8.0

Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header

• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Ansible Automation Platform 2.6
• Weak cryptography or TLS

Storage of passwords in a reversible format

• ANDRITZ HIPASE-250
• ANDRITZ 250 SCALA
• Weak cryptography or TLS
• CWE-257

ControllerAgent does not perform validation of firmware

• Phoenix Contact CHARX SEC-3150
• Phoenix Contact CHARX SEC-3100
• Weak cryptography or TLS

Improper certificate validation in node

• node
• Weak cryptography or TLS

Spring Boot DevTools remote secret generated with a non-cryptographic PRNG

• Spring Tools for Eclipse
• Weak cryptography or TLS

Improper signature verification in Google Chrome

• Google Chrome
• Weak cryptography or TLS

Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability

• Autel MaxiCharger AC Elite Home
• Weak cryptography or TLS

Improper certificate validation in Devolutions Password Manager

• Devolutions Password Manager
• Weak cryptography or TLS

Improper Certificate Validation in S2OPC

• Systerel S2OPC
• Weak cryptography or TLS

Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates

• Apache Software Foundation Apache Traffic Server
• Weak cryptography or TLS

Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

• Apache Software Foundation Apache Airflow FAB provider
• Weak cryptography or TLS

Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification

• Apache Software Foundation Apache Traffic Server
• Weak cryptography or TLS

TOTP two-factor authentication bypass vulnerability

• Three Learning Koollab LMS
• Weak cryptography or TLS