Weak cryptography or TLS.

Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery

• ceph
• Weak cryptography or TLS

Improper Certificate Validation in ASE 2000

• Applied Systems Engineering ASE2000 V2
• Weak cryptography or TLS

openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physi...

• Weak cryptography or TLS

<1.4.9 · fixed in 1.4.9

openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (f...

• Weak cryptography or TLS

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can per...

• Weak cryptography or TLS

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature...

• Weak cryptography or TLS

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without ins...

• Weak cryptography or TLS

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network pa...

• Weak cryptography or TLS

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers wit...

• Weak cryptography or TLS

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plai...

• Weak cryptography or TLS

<1.4.9 · fixed in 1.4.9

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the works...

• Weak cryptography or TLS

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. ...

• Weak cryptography or TLS

<1.4.9 · fixed in 1.4.9

Log4j2 AmqpAppender disables TLS hostname verification by default

• Spring AMQP
• Weak cryptography or TLS

CVE-2026-19854 CVE Record

• Grafana Clickhouse Datasource
• Weak cryptography or TLS

openssl_encrypt before 1.4.9 Weak Cryptographic Parameters

• jahlives openssl_encrypt
• Weak cryptography or TLS

FrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage

• FrontAccounting
• Weak cryptography or TLS

Improper certificate validation in Dell PowerProtect One

• Dell PowerProtect One
• Weak cryptography or TLS

Bucket Squatting in Vertex AI Search for Commerce

• Google Cloud Vertex AI Search for Commerce
• Weak cryptography or TLS

Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client

• gravitl netmaker
• Weak cryptography or TLS

kas Persistently Disables SSH Host Key Checking

• Weak cryptography or TLS

<5.4 · fixed in 5.4

Insecure PIN derivation mechanism in Admin By Request (ABR)

• Admin By Request (ABR)
• Broken access control
• Authentication bypass

Cleartext transmission of sensitive information in Milesight AM102/102L V2 and others

• Milesight AM102/102L V2
• Milesight AM103/103L V2
• Weak cryptography or TLS

TypeBot: Account takeover via brute-forceable 6-digit magic-link code

• baptisteArno typebot.io
• Authentication bypass
• Weak cryptography or TLS

Improper certificate validation in NVIDIA NemoClaw

• NVIDIA NemoClaw
• Weak cryptography or TLS

Weak encryption in Google Chrome

• Google Chrome
• Weak cryptography or TLS

X-AnyLabeling before 4.0.0-beta.9 Improper Certificate Validation in Model Downloads

• CVHub520 X-AnyLabeling
• Weak cryptography or TLS

WatchGuard Agent improper authentication allows unauthenticated remote code execution

• WatchGuard Agent
• Authentication bypass
• Weak cryptography or TLS

TYPO3-EXT-SA-2026-015: Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

• Weak cryptography or TLS

<3.0.6 · fixed in 3.0.6

Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Masking

• vrana adminer
• Weak cryptography or TLS

Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

• Weak cryptography or TLS

<1.5.3 · fixed in 1.5.3

HP Easy Start for macOS - Security Update

• HP Inc HP Easy Start for macOS
• Weak cryptography or TLS

Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates

• Red Hat Certificate System 10
• Red Hat Certificate System 11
• Weak cryptography or TLS

Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass

• netty
• Weak cryptography or TLS

Combodo iTop: Weak secret generation for inline image

• Combodo iTop
• Weak cryptography or TLS
• CWE-331

VeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-default WOLFCRYPT=1 builds)

• VeraCrypt
• Weak cryptography or TLS

Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE

• DJI Neo
• DJI Neo 2
• Weak cryptography or TLS

OMEN Gaming Hub – Potential Escalation of Privilege & Information Disclosure

• HP Inc OMEN Gaming Hub
• Weak cryptography or TLS

Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP

• Apache Software Foundation Apache CloudStack
• Weak cryptography or TLS

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• Weak cryptography or TLS

Azure Data Factory Elevation of Privilege Vulnerability

• Microsoft Azure Data Factory
• Weak cryptography or TLS

Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

• appwrite templates
• Weak cryptography or TLS

lin-snow Ech0 crypto.go MD5Encrypt risky encryption

• lin-snow Ech0
• Weak cryptography or TLS
• CWE-310

libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend

• libgit2
• Weak cryptography or TLS

node-opcua missing nonce verification in UserNameIdentityToken authentication

• Weak cryptography or TLS

<=2.165.0 · no fixed version yet

Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways

• TP-Link Systems Inc. ER7212PC v2
• TP-Link Systems Inc. ER605 v2
• Weak cryptography or TLS

Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching

• cesanta mongoose
• Weak cryptography or TLS

Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification

• cesanta mongoose
• Weak cryptography or TLS

Improper Certificate Validation through HTTP Event Collector Kerberos Authentication in Splunk Connect for Kafka

• Splunk Connect for Kafka
• Weak cryptography or TLS

Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR

• Splunk SOAR
• Weak cryptography or TLS

RDK-B WebUI improper cryptographic signature verification vulnerability

• RDK-B WebUI
• Weak cryptography or TLS

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• Weak cryptography or TLS

Critical flaw impacting OZOLS ERP's automatic update channel

• OZOLS
• Weak cryptography or TLS
• CWE-494

OTTO® Fleet Manager – Weak Password Hashing Configuration

• Rockwell Automation OTTO® Fleet Manager
• Weak cryptography or TLS

Power System Improper Certificate Validation

• IBM Power Systems Firmware
• Weak cryptography or TLS

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• Weak cryptography or TLS

Missing MAC validation in wg(4) packet decryption

• FreeBSD
• Weak cryptography or TLS

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify

• Weak cryptography or TLS
• CWE-757

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compar…

• Weak cryptography or TLS

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking sig…

• Broken access control
• Weak cryptography or TLS

Missing JSON Web Token signature validation in Otalio Ship Property Management System

• Otalio Ship Property Management System
• Weak cryptography or TLS