Weak cryptography or TLS.

Improper signature verification in Apple macOS

• Apple macOS
• Weak cryptography or TLS

An issue in Eufy Homebase 2 version 3.3.4.1h allows a local attacker to obtain sensitive information via the cryptographic scheme.

• Weak cryptography or TLS

NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching

• Authentication bypass
• Weak cryptography or TLS

* · no fixed version yet

mod_gnutls missing key purpose check in client certificate verification

• airtower-luna mod_gnutls
• Weak cryptography or TLS

HybridAuth Has Improper SSL Certificate Validation in Curl HTTP Client

• Authentication bypass
• Weak cryptography or TLS

<=3.12.2 · no fixed version yet

Shenzhen HCC Technology MPOS M6 PLUS Cardholder Data cleartext transmission

• Shenzhen HCC Technology MPOS M6 PLUS
• Weak cryptography or TLS
• CWE-310

jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic

• Weak cryptography or TLS

<11.1.1 · fixed in 11.1.1

jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation

• Weak cryptography or TLS
• CWE-1023

>=7.0.0, <11.1.1 · fixed in 11.1.1

PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification

• PuTTY
• Weak cryptography or TLS
• CWE-345

janmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verification

• janmojzis tinyssh
• Weak cryptography or TLS
• CWE-345

Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information

• Automated Logic WebCTRL Premium Server
• Weak cryptography or TLS

AVideo has an unauthenticated decrypt oracle leaking any ciphertext

• Authentication bypass
• Information disclosure

<=26.0 · no fixed version yet

AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin

• Weak cryptography or TLS

<=26.0 · no fixed version yet

Cryptomator: Hub unlocking accepts plaintext HTTP and unvalidated endpoint schemes

• cryptomator
• Weak cryptography or TLS

Improper certificate validation in Devolutions Server

• Devolutions Server
• Weak cryptography or TLS

Yi Technology YI Home Camera HTTP Firmware Update ipc signature verification

• Yi Technology YI Home Camera
• Weak cryptography or TLS
• CWE-345

Anchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSS

• openVESSL Anchorr
• Cross-site scripting (XSS)
• Weak cryptography or TLS

MinIO has JWT Algorithm Confusion in OIDC Authentication

• Authentication bypass
• Weak cryptography or TLS

<=0.0.0-20260212201848-7aac2a2c5b7c · no fixed version yet

step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)

• Authentication bypass
• Weak cryptography or TLS

<0.30.0 · fixed in 0.30.0

Unsigned SAML LogoutRequest Acceptance in gosaml2

• Weak cryptography or TLS

<0.11.0 · fixed in 0.11.0

validateSignature Loop Variable Capture Signature Bypass in goxmldsig

• Weak cryptography or TLS
• CWE-682

<1.6.0 · fixed in 1.6.0

Improper certificate validation in Devolutions Hub Reporting Service

• Devolutions Hub Reporting Service
• Weak cryptography or TLS

Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121

• Weak cryptography or TLS
• CWE-1395

<1.2.3-0.20260316182343-b3364f3f32e7 · fixed in 1.2.3-0.20260316182343-b3364f3f32e7

Edimax GS-5008PL <= 1.00.54 Transmits Credentials Over Cleartext HTTP

• EDIMAX Technology Co., Ltd. Edimax GS-5008PL
• Weak cryptography or TLS

JetKVM insufficient firmware verification

• JetKVM
• Weak cryptography or TLS
• CWE-345

GL-iNet Comet (GL-RM1) KVM insufficient certificate validation

• GL-iNet Comet KVM
• Weak cryptography or TLS

ScreenConnect Instance Level Cryptographic Material Exposure

• ConnectWise ScreenConnect
• Weak cryptography or TLS

sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey

• Weak cryptography or TLS
• CWE-325

<1.0.9 · fixed in 1.0.9

Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

• Information disclosure
• Weak cryptography or TLS

<1.6.9 · fixed in 1.6.9

Authlib JWS JWK Header Injection: Signature Verification Bypass

• Weak cryptography or TLS

<1.6.9 · fixed in 1.6.9

Improper signature verification in HCL AION

• HCL AION
• Weak cryptography or TLS

OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured

• Weak cryptography or TLS

<2026.3.12 · fixed in 2026.3.12

cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy

• yhirose cpp-httplib
• Weak cryptography or TLS

Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability

• Philips Hue Bridge
• Weak cryptography or TLS

PyJWT accepts unknown `crit` header extensions

• Weak cryptography or TLS
• Broken access control

<2.12.0 · fixed in 2.12.0

JumpServer Improper Certificate Validation in Custom SMS API Client

• jumpserver
• Weak cryptography or TLS

IBM Sterling Partner Engagement Manager Information Disclosure

• IBM Sterling Partner Engagement Manager
• Weak cryptography or TLS

SM9 Infinity-Point Ciphertext Forgery Vulnerability

• Weak cryptography or TLS
• CWE-20

<0.41.1 · fixed in 0.41.1

Poseidon V1 variable-length input collision via implicit zero-padding

• Weak cryptography or TLS

<25.0.1 · fixed in 25.0.1

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

• Trane Tracer SC
• Trane Tracer Concierge
• Weak cryptography or TLS

Improper certificate validation in Lenovo FileZ

• Lenovo FileZ
• Weak cryptography or TLS

Improper certificate validation in Lenovo FileZ

• Lenovo FileZ
• Weak cryptography or TLS

Improper certificate validation in Dell Alienware Command Center (AWCC)

• Dell Alienware Command Center (AWCC)
• Weak cryptography or TLS

Striae has a hash validation utility vulnerability

• Weak cryptography or TLS
• CWE-353

>=0.9.22-0, <3.0.0 · fixed in 3.0.0

Video Station

• QNAP Systems Inc. Video Station
• Weak cryptography or TLS

Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go

• Weak cryptography or TLS

<=1.1.3-0.20250606002314-b4a2dfeb7b0f · no fixed version yet

Acrobat Reader | Improper Certificate Validation (CWE-295)

• Adobe Acrobat DC
• Adobe Acrobat Reader DC
• Weak cryptography or TLS

Azure IoT Explorer Information Disclosure Vulnerability

• Microsoft Azure IoT Explorer
• Authentication bypass
• Weak cryptography or TLS

Azure IoT Explorer Information Disclosure Vulnerability

• Microsoft Azure IoT Explorer
• Weak cryptography or TLS

Improper certificate validation in Fortinet FortiAnalyzer and others

• Fortinet FortiAnalyzer
• Fortinet FortiManager
• Weak cryptography or TLS

Use of a Broken or Risky Cryptographic Algorithm for firmware images of power analyzer

• Janitza UMG 96RM-E 24V(5222063)
• Janitza UMG 96RM-E 230V(5222062)
• Weak cryptography or TLS

HTTP signature verification can be bypassed

• misskey
• Weak cryptography or TLS

Signature bypass on update upload

• MBS UBR-01 Mk II
• MBS UBR-02
• Weak cryptography or TLS

Secret leak with wwwdnload.cgi

• MBS UBR-01 Mk II
• MBS UBR-02
• Weak cryptography or TLS

Taipower｜Taipower APP(Android) - Improper Certificate Validation

• Taipower APP
• Weak cryptography or TLS

An issue pertaining to CWE-319: Cleartext Transmission of Sensitive Information was discovered in Nexusoft NexusInterface v3.2.0-beta.2.

• Weak cryptography or TLS

mkj Dropbear S Range Check curve25519.c unpackneg signature verification

• mkj Dropbear
• Weak cryptography or TLS
• CWE-345

Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission

• Mendi Neurofeedback Headset
• Weak cryptography or TLS
• CWE-310

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

• Weak cryptography or TLS
• CWE-350

>=3.8.0, <3.8.6 || >=3.9.0, <3.9.5 · fixed in 3.8.6, 3.9.5

Wallos: Server-Side Request Forgery (SSRF) in Notification Testers

• ellite Wallos
• Weak cryptography or TLS
• Server-side request forgery (SSRF)