Weak cryptography or TLS.

Weak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® Classic

• Progress Software Progress® Telerik® Fiddler® Classic
• Weak cryptography or TLS

sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission

• sgl-project sglang
• Weak cryptography or TLS
• CWE-310

SourceCodester Drug Recommendation System Password add_user.php missing encryption

• SourceCodester Drug Recommendation System
• Weak cryptography or TLS
• CWE-310

maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification

• maclof kubernetes-client
• Weak cryptography or TLS

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext

• Weak cryptography or TLS

alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

• alexpechkarev google-maps
• Weak cryptography or TLS

Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

• defunkt gist
• Weak cryptography or TLS

gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

• go-pay gopay
• Weak cryptography or TLS

Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

• cockpit
• Weak cryptography or TLS

go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper

• go-micro
• Weak cryptography or TLS

invariant-systems-ai aiir Policy Gate signature verification

• invariant-systems-ai aiir
• Weak cryptography or TLS
• CWE-345

YzmCMS MD5 system.func.php password weak password hash

• YzmCMS
• Weak cryptography or TLS

OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession

• OpenIdentityPlatform OpenAM
• Weak cryptography or TLS

BLS12-381 key validation accepts a public key built on a foreign curve

• Legion of the Bouncy Castle Inc. BC-JAVA
• Weak cryptography or TLS

MLS X.509 credential not bound to the LeafNode signature key

• Legion of the Bouncy Castle Inc. BC-JAVA
• Authentication bypass
• Weak cryptography or TLS

OpenPGP data signature accepted from a signing subkey without cross-certification

• Legion of the Bouncy Castle Inc. BC-JAVA
• Weak cryptography or TLS
• CWE-345

PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Weak cryptography or TLS

Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match

• Apache Software Foundation Apache Thrift
• Weak cryptography or TLS

Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op

• Apache Software Foundation Apache Thrift
• Weak cryptography or TLS
• CWE-393

Apache Thrift: Perl TLS client disables certificate verification by default

• Apache Software Foundation Apache Thrift
• Weak cryptography or TLS
• CWE-1188

Improper signature verification in Moxa MGate MB3170 Series and others

• Moxa MGate MB3170 Series
• Moxa MGate MB3270 Series
• Weak cryptography or TLS

Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot Platform

• HAVELSAN Inc. Sef - AI Chatbot Platform
• Weak cryptography or TLS

Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts

• Legion of the Bouncy Castle Inc. bc-csharp
• Weak cryptography or TLS

Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix

• Legion of the Bouncy Castle Inc. bc-csharp
• Weak cryptography or TLS

URI name constraints checked against a mis-parsed host

• Legion of the Bouncy Castle Inc. bc-csharp
• Weak cryptography or TLS

Attribute certificate path validation does not verify the attribute certificate's signature

• Legion of the Bouncy Castle Inc. bc-csharp
• Weak cryptography or TLS

GV-Eye Sensitive information exposure in URL query parameter Vulnerability

• GeoVision Inc. GV-Eye
• Weak cryptography or TLS

SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability

• Thales SConnect
• Weak cryptography or TLS
• Memory corruption

Cleartext transmission of sensitive information in Johnson Controls EasyIO NEO

• Johnson Controls EasyIO NEO
• Weak cryptography or TLS

PictShare < 3.7.1 Predictable Delete Code via rand()

• HaschekSolutions pictshare
• Weak cryptography or TLS

Unencrypted UDP Control Traffic in Teledyne FLIR Robots running Aware2

• Teledyne FLIR Aware2
• Weak cryptography or TLS

Unencrypted 802.11 Network in Teledyne FLIR Robots running Aware2

• Teledyne FLIR Aware2
• Weak cryptography or TLS

Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2

• Teledyne FLIR Aware2
• Weak cryptography or TLS

Joyland AI WebView accepts invalid SSL certificates

• Joyland.ai
• Weak cryptography or TLS

Joyland AI enables HTTP

• Joyland.ai
• Weak cryptography or TLS

Joyland AI hostname checking disabled

• Joyland.ai
• Weak cryptography or TLS

Joyland AI accepts TLS certificates without validation

• Joyland.ai
• Weak cryptography or TLS

GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover

• GetSimpleCMS-CE
• Weak cryptography or TLS
• CWE-640

Confluent Kafka Python Improper TLS Certificate Validation

• confluent-kafka
• Weak cryptography or TLS

Fortra BoKS Server Agent adjoin machine-account password generation vulnerability

• Fortra Core Privileged Access Manager (BoKS)
• Weak cryptography or TLS

HCL BigFix Service Management is affected by multiple security vulnerabilities.

• HCL Software HCL BigFix Service Management
• Weak cryptography or TLS

Predictable Active Directory service-account passwords in BoKS Manager

• Fortra BoKS Manager boks-server
• Weak cryptography or TLS

Apache APISIX: unauthenticated impersonation issue in saml-auth

• Apache Software Foundation Apache APISIX
• Weak cryptography or TLS

n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification

• n8n
• Weak cryptography or TLS

Authentication information or sensitive data may be intercepted in transit

• Hitachi Industrial Equipment Systems Hitachi Coding Software Suite
• Weak cryptography or TLS

Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange

• Weak cryptography or TLS

<0.63.0 · fixed in 0.63.0

Tugtainer: OIDC id_token claims accepted without signature/audience/expiry verification

• Quenary tugtainer
• Weak cryptography or TLS

SSLContext.wrap_bio() missing validation of server_hostname parameter

• Python Software Foundation CPython
• Weak cryptography or TLS

Improper signature verification in NVIDIA GeForce and others

• NVIDIA GeForce
• NVIDIA RTX, Quadro, NVS
• Weak cryptography or TLS

UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding

• shrec UltrafastSecp256k1
• Weak cryptography or TLS
• CWE-345

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

• Weak cryptography or TLS

<1.13.6 || >=1.14.0, <1.14.5 · fixed in 1.13.6, 1.14.5

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

• Weak cryptography or TLS
• CWE-440

>=1.26.0, <2.8.0 · fixed in 2.8.0

Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation

• Cato Networks SDP Client
• Path traversal
• Weak cryptography or TLS

Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade

• Apache Software Foundation Apache PLC4X
• Weak cryptography or TLS
• CWE-757

Improper certificate validation in Pgpool Global Development Group Pgpool-II

• Pgpool Global Development Group Pgpool-II
• Weak cryptography or TLS

PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

• Weak cryptography or TLS

>=2.13.0, <2.14.0 · fixed in 2.14.0

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

• Weak cryptography or TLS

<2.14.0 · fixed in 2.14.0

PyJWT accepts public JWK containers as HMAC secrets

• Weak cryptography or TLS

>=2.13.0, <2.14.0 · fixed in 2.14.0

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

• Weak cryptography or TLS

>=2.4.0, <2.14.0 · fixed in 2.14.0

PyJWT BOM Bypass

• Weak cryptography or TLS

>=2.13.0, <2.14.0 · fixed in 2.14.0