Weak cryptography or TLS.

XikeStor SKS8310-8X Predictable Session Identifiers

• Anhui Seeker Electronic Technology Co., LTD. XikeStor SKS8310-8X
• Weak cryptography or TLS

Incorrect enforcement of email constraints in crypto/x509

• Weak cryptography or TLS

>=1.26.0-0, <1.26.1 · fixed in 1.26.1

Flowise has Insufficient Password Salt Rounds

• Weak cryptography or TLS

<3.0.13 · fixed in 3.0.13

Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure

• Authentication bypass
• Weak cryptography or TLS

<2.3.3 · fixed in 2.3.3

RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)

• rustdesk-client RustDesk Client
• Weak cryptography or TLS
• Prototype pollution

RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force

• rustdesk-client RustDesk Client
• Weak cryptography or TLS

RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure

• rustdesk-client RustDesk Client
• Weak cryptography or TLS

RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation

• rustdesk-client RustDesk Client
• Weak cryptography or TLS
• CWE-684

RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption

• rustdesk-server-pro RustDesk Server Pro
• Weak cryptography or TLS
• CWE-684

Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator

• DOUGDUDE Net::NSCA::Client
• Weak cryptography or TLS

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id

• CHORNY Apache::Session::Generate::MD5
• Weak cryptography or TLS
• CWE-340

Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely

• KAZEBURO Plack::Middleware::Session::Simple
• Weak cryptography or TLS
• CWE-340

pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT

• Weak cryptography or TLS

>=6.0.4.1, <6.3.3 || >=5.0.0-RC1, <5.7.9 || <4.5.9 · fixed in 6.3.3, 5.7.9, 4.5.9

Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification

• Weak cryptography or TLS

>=1.6.5, <1.6.7 · fixed in 1.6.7

Insufficiently random values in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and others

• Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
• Cisco Secure Firewall Threat Defense (FTD) Software
• Weak cryptography or TLS

Frame Injection via Shared GTK Allows Traffic Spoofing and Client Compromise

• Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8)
• Weak cryptography or TLS

Lack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0

• Nozomi Networks Arc
• Weak cryptography or TLS

S/MIME Certificate Subject Whitespace

• SEPPmail Secure Email Gateway
• Weak cryptography or TLS

PGP Signature Reflection

• SEPPmail Secure Email Gateway
• Weak cryptography or TLS

Missing PGP Signature Tag

• SEPPmail Secure Email Gateway
• Weak cryptography or TLS

A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.2 allows attackers to reverse engineer…

• Weak cryptography or TLS

OpenClaw has an opt-in insecure Control UI auth over plaintext HTTP could allow privileged access

• Command injection
• Broken access control

<2026.2.21 · fixed in 2026.2.21

OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)

• Command injection
• Weak cryptography or TLS

<2026.2.19 · fixed in 2026.2.19

Improper certificate validation in Devolutions Remote Desktop Manager

• Devolutions Remote Desktop Manager
• Weak cryptography or TLS

IBM MQ Appliance uses weaker than expected cryptographic algorithms

• IBM MQ Appliance
• Weak cryptography or TLS

IBM Aspera faspio Gateway 1.3.7 has addressed a vulnerability affected by weak cryptographic algorithms

• IBM Aspera faspio Gateway
• Weak cryptography or TLS

IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that report metrics are vulnerable to loss of confidentiality

• IBM App Connect Operator
• IBM App Connect EnterpriseCertified Containers Operands
• Weak cryptography or TLS

Rancher's weave CNI password is not configured when a cluster is created from an RKE template

• Weak cryptography or TLS

>=2.5.0, <2.5.14 || >=2.6.0, <2.6.5 · fixed in 2.5.14, 2.6.5

Apache Ranger Vulnerable to Improper Validation of Certificate with Host Mismatch

• Weak cryptography or TLS

<2.8.0 · fixed in 2.8.0

Dataease SQLBot JWT Token auth.py validateEmbedded signature verification

• Dataease SQLBot
• Weak cryptography or TLS
• CWE-345

Cleartext transmission of sensitive information in Gallagher NxWitness VMS and Hanwha VMS Integrations

• Gallagher NxWitness VMS and Hanwha VMS Integrations
• Weak cryptography or TLS

Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to use a weak cryptography algorithm for data encryption, allowing attackers to trivially reverse the encyption and expose…

• Weak cryptography or TLS

@keep-network/tbtc-v2 revealing P2PKH deposit with a wrapped P2SH script

• Weak cryptography or TLS

<1.8.2 · fixed in 1.8.2

Cleartext transmission of sensitive information in Google Android

• Google Android
• Weak cryptography or TLS

PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

• Weak cryptography or TLS

>=0.24.0, <0.38.0 · fixed in 0.38.0

PKCS7_verify Signature Validation Bypass in AWS-LC

• Weak cryptography or TLS

>=0.24.0, <0.38.0 · fixed in 0.38.0

In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in cleartext, including the user's name, e-…

• Weak cryptography or TLS

Gradio has an Open Redirect in its OAuth Flow

• Information disclosure
• Broken access control

<6.6.0 · fixed in 6.6.0

HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function

• TOKUHIROM HTTP::Session2
• Weak cryptography or TLS
• CWE-340

SODOLA SL902-SWTGW124AS <= 200.1.20 Predictable Session ID

• Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks) SODOLA SL902-SWTGW124AS
• Weak cryptography or TLS

SODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token Generation

• Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks) SODOLA SL902-SWTGW124AS
• Weak cryptography or TLS

SODOLA SL902-SWTGW124AS <= 200.1.20 Cleartext Credential Transmission

• Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks) SODOLA SL902-SWTGW124AS
• Weak cryptography or TLS

Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass

• Weak cryptography or TLS

<26.4.4 · fixed in 26.4.4

Broken or risky cryptographic algorithm in SICK AG SICK LMS1000 and others

• SICK AG SICK LMS1000
• SICK AG SICK MRS1000
• Weak cryptography or TLS

Broken or risky cryptographic algorithm in SICK AG SICK LMS1000 and others

• SICK AG SICK LMS1000
• SICK AG SICK MRS1000
• Weak cryptography or TLS

Copeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic Algorithm

• Copeland XWEB 300D PRO
• Copeland XWEB 500D PRO
• Weak cryptography or TLS

Apache::SessionX versions through 2.01 for Perl create insecure session id

• GRICHTER Apache::SessionX
• Weak cryptography or TLS
• CWE-340

Fleet: Device lock PIN can be predicted if lock time is known

• Weak cryptography or TLS

<4.80.1 · fixed in 4.80.1

Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

• Weak cryptography or TLS
• CWE-345

<8.6.3 || >=9.0.0, <9.3.1-alpha.4 · fixed in 8.6.3, 9.3.1-alpha.4

ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation

• Weak cryptography or TLS

<=1.6.2 · no fixed version yet

An improper certificate validation vulnerability was found in the FTP Backup on the ADM.

• ASUSTOR ADM
• Weak cryptography or TLS

FreeScout's Predictable Authentication Token Enables Account Takeover

• freescout
• Weak cryptography or TLS

OpenEMR Has Disabled SSL Certificate Verification in HTTP Client

• openemr
• Weak cryptography or TLS

Piwigo's secret key can be brute forced

• Piwigo
• Weak cryptography or TLS

Binardat 10G08-0800GSM Network Switch Hard-coded RC4 Encryption Key

• Binardat Ltd. 10G08-0800GSM Network Switch
• Hard-coded credentials
• Weak cryptography or TLS

Binardat 10G08-0800GSM Network Switch Predictable Session Identifiers

• Binardat Ltd. 10G08-0800GSM Network Switch
• Weak cryptography or TLS

Smolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functions

• WONKO Smolder
• Weak cryptography or TLS

yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent

• Weak cryptography or TLS

<=1.12.0 · no fixed version yet

Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification

• Cesanta Mongoose
• Weak cryptography or TLS
• CWE-345

Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values

• Cesanta Mongoose
• Weak cryptography or TLS
• CWE-310