Weak cryptography or TLS.

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in jxcore jxm master.

• Weak cryptography or TLS

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in fofolee uTools-quickcommand 5.0.3.

• Weak cryptography or TLS

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master.

• Weak cryptography or TLS

Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication

• strimzi-kafka-operator
• Authentication bypass
• Weak cryptography or TLS

Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters

• strimzi-kafka-operator
• Weak cryptography or TLS
• CWE-296

Traefik affected by TLS ClientAuth Bypass on HTTP/3

• Weak cryptography or TLS
• CWE-1395

<=1.7.34 · no fixed version yet

Jinan USR IOT Technology Limited (PUSR) USR-W610 Cleartext Transmission of Sensitive Information

• Jinan USR IOT Technology Limited (PUSR) USR-W610
• Weak cryptography or TLS

Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped

• Weak cryptography or TLS

<3.0.5 · fixed in 3.0.5

OpenClaw replaced a deprecated sandbox hash algorithm

• Weak cryptography or TLS

<2026.2.15 · fixed in 2026.2.15

Apache Tomcat has an Improper Input Validation vulnerability

• Weak cryptography or TLS
• CWE-20

>=11.0.0-M1, <11.0.18 || >=10.1.0-M7, <10.1.52 || >=9.0.83, <9.0.115 · fixed in 11.0.18, 10.1.52, 9.0.115

Apache Tomcat - Client certificate verification bypass

• Weak cryptography or TLS
• CWE-20

>=11.0.0-M1, <11.0.15 || >=10.1.0-M1, <10.1.50 || >=9.0.0-M1, <9.0.113 || >=8.5.0, <=8.5.100 · fixed in 11.0.15, 10.1.50, 9.0.113

IBM Security QRadar EDR Software has multiple vulnerabilities

• IBM Security QRadar EDR
• Weak cryptography or TLS

Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows

• IBM DB2 Recovery Expert for LUW
• Weak cryptography or TLS

Multiple Vulnerabilities in IBM Concert Software.

• IBM Concert
• Weak cryptography or TLS

OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing

• Weak cryptography or TLS
• Broken access control

>=2.0.0-beta3, <2026.2.12 · fixed in 2026.2.12

Beetel 777VR1 SSH Service risky encryption

• Beetel 777VR1
• Weak cryptography or TLS
• CWE-310

An issue in the TLS certification mechanism of Guardian Gryphon v01.06.0006.22 allows attackers to execute commands as root.

• Weak cryptography or TLS

Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids

• BVA Concierge::Sessions
• Weak cryptography or TLS
• CWE-340

Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely

• TEEJAY Maypole
• Weak cryptography or TLS

Micca KE700 Cleartext transmission of key fob ID

• Micca Auto Electronics Co., Ltd. Car Alarm System KE700
• Weak cryptography or TLS

Absence of Kernel Module Signature Verification on Linux System of Infotainment ECU

• Bosch Infotainment system ECU
• Weak cryptography or TLS

Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon

• Thalesgroup SafeNet Agent for Windows Logon
• Weak cryptography or TLS

Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception

• TP-Link Systems Inc. Tapo App
• TP-Link Systems Inc. Kasa App
• Weak cryptography or TLS

WWW::OAuth 1.000 and earlier for Perl uses insecure rand() function for cryptographic functions

• DBOOK WWW::OAuth
• Weak cryptography or TLS

authentik has a Signature Verification Bypass via SAML Assertion Wrapping

• authentik
• Authentication bypass
• Weak cryptography or TLS

newbee-mall Unsalted MD5 Password Hashing Enables Offline Credential Cracking

• newbee-ltd newbee-mall
• Weak cryptography or TLS

Xiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITM

• Xiaomi Technology Co., Ltd. Galaxy FDS Android SDK
• Weak cryptography or TLS

Insecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud Connection

• SolaX Power Pocket WiFi 3.0
• SolaX Power Pocket WiFi+LAN
• Weak cryptography or TLS

Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud Connection

• SolaX Power Pocket WiFi 3.0
• SolaX Power Pocket WiFi+LAN
• Weak cryptography or TLS

PAN-OS: Improper Validation of Terminal Server Agent Certificate

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks PAN-OS
• Weak cryptography or TLS

Improper Access Control in Pan Software's PanCafe Pro

• Pan Software & Information Technologies Ltd. PanCafe Pro
• Weak cryptography or TLS

An issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive information.

• Weak cryptography or TLS

Azure Local Remote Code Execution Vulnerability

• Microsoft Azure Local
• Weak cryptography or TLS

XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform

• SAP_SE SAP NetWeaver AS ABAP and ABAP Platform
• Weak cryptography or TLS

SumatraPDF Update MITM -> Arbitrary Code Execution

• sumatrapdf
• Weak cryptography or TLS
• CWE-494

Keycloak affected by improper invitation token validation

• Weak cryptography or TLS

>=26.5.0, <26.5.3 || <26.2.13 || >=26.3.0, <26.4.9 · fixed in 26.5.3, 26.2.13, 26.4.9

Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure

• Weak cryptography or TLS

<2.52.11 · fixed in 2.52.11

Improper certificate validation in Eaton Network M3

• Eaton Network M3
• Weak cryptography or TLS

Broken or risky cryptographic algorithm in Yokogawa Electric Corporation FAST/TOOLS

• Yokogawa Electric Corporation FAST/TOOLS
• Weak cryptography or TLS

Broken or risky cryptographic algorithm in Yokogawa Electric Corporation FAST/TOOLS

• Yokogawa Electric Corporation FAST/TOOLS
• Weak cryptography or TLS

Cleartext transmission of sensitive information in Yokogawa Electric Corporation FAST/TOOLS

• Yokogawa Electric Corporation FAST/TOOLS
• Weak cryptography or TLS

DataHub's LDAP Ingestion Source vulnerable to MITM attack through TLS downgrade

• datahub
• Weak cryptography or TLS

Blocklist Bypass possible via ECDSA Signature Malleability

• Weak cryptography or TLS

>=1.7.0, <1.10.3 · fixed in 1.10.3

Tanium addressed an improper certificate validation vulnerability in Tanium Appliance.

• Tanium Appliance
• Weak cryptography or TLS

Improper Certificate Validation in TP-Link Tapo H100 and P100 Allows Man-in-the-Middle Attack

• TP-Link Systems Inc. Tapo H100 v1
• TP-Link Systems Inc. Tapo P100 v1
• Weak cryptography or TLS

Unexpected session resumption in crypto/tls

• Weak cryptography or TLS

<1.24.13 || >=1.25.0-0, <1.25.7 || >=1.26.0-rc.1, <1.26.0-rc.3 · fixed in 1.24.13, 1.25.7, 1.26.0-rc.3

Cleartext transmission of sensitive information in Moxa UC-1200A Series

• Moxa UC-1200A Series
• Weak cryptography or TLS

EVE Seals Vault Key With SHA1 PCRs

• Weak cryptography or TLS
• Hard-coded credentials

<0.0.0-20230519072751-977f42b07fa9 · fixed in 0.0.0-20230519072751-977f42b07fa9

EVE Doesn't Measure Config Partition From 2 Fronts

• Weak cryptography or TLS
• Hard-coded credentials

<0.0.0-20230126065759-d9383a7ee4e1 · fixed in 0.0.0-20230126065759-d9383a7ee4e1

Alist has Insecure TLS Config

• Weak cryptography or TLS

<3.57.0 · fixed in 3.57.0

Tenda AC7 Transmits Admin Credentials Without HTTPS Protection

• Shenzhen Tenda Technology Co., Ltd. Tenda AC7
• Weak cryptography or TLS

Rapid7 InsightVM Signature Validation Vulnerability

• Rapid7 Vulnerability Management
• Authentication bypass
• Weak cryptography or TLS

An improper certificate validation vulnerability was found in a third-party NAT traversal module.

• ASUSTOR ADM
• Weak cryptography or TLS

An improper certificate validation vulnerability was found in ADM while querying an external server for the device's WAN IP address.

• ASUSTOR ADM
• Weak cryptography or TLS

An improper certificate validation vulnerability was found in ADM while sending HTTPS requests to the server.

• ASUSTOR ADM
• Weak cryptography or TLS

An improper certificate validation vulnerability was found in ADM while updating the DDNS settings.

• ASUSTOR ADM
• Weak cryptography or TLS

SageMaker Python SDK has Exposed HMAC

• Information disclosure
• Weak cryptography or TLS

<2.256.0 || >=3.0, <3.2.0 · fixed in 2.256.0, 3.2.0

SageMaker Python SDK has Insecure TLS Configuration

• Weak cryptography or TLS
• CWE-599

<2.256.0 || >=3.0, <3.1.1 · fixed in 2.256.0, 3.1.1

Juju has broken CMR authorization in github.com/juju/juju

• Weak cryptography or TLS
• CWE-672

* · no fixed version yet

fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation

• Weak cryptography or TLS

<1.5.1 · fixed in 1.5.1