Weak cryptography or TLS.

MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor

• Weak cryptography or TLS

wolfSSL CA-cache hit overrides callback

• curl
• Weak cryptography or TLS

OpenSSL pinning bypass

• curl
• Weak cryptography or TLS

TLS server impersonation possible in Mikrotik RouterOS

• Mikrotik RouterOS
• Weak cryptography or TLS

SSH user impersonation possible in Mikrotik RouterOS

• Mikrotik RouterOS
• Weak cryptography or TLS

WWBN AVideo Weak PRNG Password Generation via External Login

• WWBN AVideo
• Weak cryptography or TLS

Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass

• Bilibili Desktop
• Weak cryptography or TLS

SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor

• Weak cryptography or TLS
• CWE-296

<13.3.2 · fixed in 13.3.2

IBM i is Affected By Cryptographic Algorithm Weakness in DCM []

• i
• Weak cryptography or TLS

IBM i is Affected By Multiple Vulnerabilities in Debug Server

• i
• Weak cryptography or TLS

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

• IBM Cloud Pak for Business Automation
• Weak cryptography or TLS

Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint

• Checkmk
• Weak cryptography or TLS

Improper OCSP response validation in Snowflake drivers

• Snowflake Connector for Python
• Snowflake Go Driver
• Weak cryptography or TLS

Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP

• Apache Software Foundation Apache SkyWalking
• Weak cryptography or TLS

Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing.

• Weak cryptography or TLS

Copilot Studio Elevation of Privilege Vulnerability

• Microsoft Copilot Studio
• Weak cryptography or TLS

node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements

• Weak cryptography or TLS
• CWE-20

<=1.4.0 · no fixed version yet

python-jose algorithm confusion guard bypassed by DER-encoded public keys

• Weak cryptography or TLS

<=3.5.0 · no fixed version yet

Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Vulnerabilities exists in IBM Netezza Software

• IBM Netezza Software
• Weak cryptography or TLS

Vulnerabilities exists in IBM Netezza Software

• IBM Netezza Software
• Weak cryptography or TLS

Improper certificate validation in Eclipse Foundation Eclipse aeriOS

• Eclipse Foundation Eclipse aeriOS
• Weak cryptography or TLS

MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks

• misp
• Weak cryptography or TLS

Improper certificate validation in Eclipse Foundation Eclipse Arrowhead

• Eclipse Foundation Eclipse Arrowhead
• Authentication bypass
• Weak cryptography or TLS

Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads

• WSO2 API Manager
• WSO2 API Control Plane
• Weak cryptography or TLS

Improper signature verification in Siemens Mendix SAML (Mendix 10 compatible) and others

• Siemens Mendix SAML (Mendix 10 compatible)
• Siemens Mendix SAML (Mendix 11 compatible)
• Weak cryptography or TLS

Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

• Weak cryptography or TLS

<2.17 · fixed in 2.17

Missing encryption of sensitive data in Jenkins Project Jenkins Parameterized Remote Trigger Plugin

• Jenkins Project Jenkins Parameterized Remote Trigger Plugin
• Weak cryptography or TLS

Improper certificate validation in Eclipse Foundation Eclipse aeriOS

• Eclipse Foundation Eclipse aeriOS
• Weak cryptography or TLS

Authenticated Signature Verification Bypass Leading to Arbitrary Code Execution in AOS-CX

• Hewlett Packard Enterprise (HPE) AOS-CX
• Weak cryptography or TLS

Unauthenticated Sensitive Information Disclosure via Man-in-the-Middle in AOS-CX via API Endpoint

• Hewlett Packard Enterprise (HPE) AOS-CX
• Weak cryptography or TLS

Unauthenticated Information Disclosure Leading to Data Exposure in HPE Networking Fabric Composer

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Weak cryptography or TLS

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

• Information disclosure
• Weak cryptography or TLS

>=10.7.0, <10.34.5 || >=11.0.0, <11.11.0 · fixed in 10.34.5, 11.11.0

Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm

• Ebyte NA111-M Firmware
• Weak cryptography or TLS

ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE

• Proper Fraction ProfilePress
• Authentication bypass
• Weak cryptography or TLS

Phison PS3111-S11 Controller Firmware Signature Verification Bypass

• Phison Electronics Corporation PS3111-S11 Controller Firmware
• Weak cryptography or TLS

Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

• Weak cryptography or TLS

<=8.0.7 · no fixed version yet

AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

• Weak cryptography or TLS

>=0.10.8, <1.3.1 · fixed in 1.3.1

TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values

• TOTOLINK N600R
• Weak cryptography or TLS
• CWE-310

AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token

• WWBN AVideo
• Weak cryptography or TLS

Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

• Weak cryptography or TLS

>=3.2.0-beta.1, <3.9.0 · fixed in 3.9.0

pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

• pac4j
• Weak cryptography or TLS

Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in

• omnivore
• Weak cryptography or TLS

Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key

• Newsletters
• Weak cryptography or TLS

BOSH vSphere CPI Improper Cert Validation

• Cloud Foundry bosh-vsphere-cpi-release
• Weak cryptography or TLS

org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

• Weak cryptography or TLS
• Hard-coded credentials

<1.4.1 · fixed in 1.4.1

org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

• Weak cryptography or TLS
• Hard-coded credentials

<2.7.14 || >=3.0.0, <3.3.5 || >=3.4.0, <3.4.3 || >=3.5.0, <3.5.9 · fixed in 2.7.14, 3.3.5, 3.4.3, 3.5.9

MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

• Weak cryptography or TLS
• Hard-coded credentials

<3.2.4 || >=3.3.0, <3.3.3 || >=3.4.0, <3.4.6 || >=3.5.0, <3.5.3 · fixed in 3.2.4, 3.3.3, 3.4.6, 3.5.3

Multiple Vulnerabilities in IBM Concert Software

• IBM Concert
• Weak cryptography or TLS

IBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate validation vulnerability in JWT service component

• IBM Integrated Analytics System
• Weak cryptography or TLS

BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

• MongoDB BI Connector
• Weak cryptography or TLS

AIIR verification and policy gates could report success without enforcing the control (fail-open)

• Weak cryptography or TLS
• CWE-636

<1.7.0 · fixed in 1.7.0

MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`

• Weak cryptography or TLS
• Hard-coded credentials

<3.2.4 || >=3.3.0, <3.3.3 || >=3.4.0, <3.4.6 || >=3.5.0, <3.5.3 · fixed in 3.2.4, 3.3.3, 3.4.6, 3.5.3

Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

• Weak cryptography or TLS
• CWE-208

<5.14.1 · fixed in 5.14.1

WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion

• wpmudev WPMU DEV Dashboard
• Weak cryptography or TLS

Ebyte NA111-M Cleartext Transmission of Sensitive Information

• Ebyte NA111-M Firmware
• Weak cryptography or TLS

Ebyte NA111-M Cleartext Transmission of Sensitive Information

• Ebyte NA111-M Firmware
• Weak cryptography or TLS

RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission

• RooCodeInc Roo-Code
• Weak cryptography or TLS
• CWE-310

Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation

• ceph
• Weak cryptography or TLS

Ceph: CephX AES Authentication error

• ceph
• Weak cryptography or TLS