Weak cryptography or TLS.

Improper authentication in Progress MarkLogic Server SAML processing

• Progress Software Corporation MarkLogic Server
• Authentication bypass
• Weak cryptography or TLS

FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request

• FreeRDP
• Weak cryptography or TLS

Hex trusts its bundled CA certificates when cacerts_path is set

• hex
• Weak cryptography or TLS

SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates

• sbabic swupdate
• Weak cryptography or TLS

hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

• Weak cryptography or TLS
• CWE-636

>=0.1.0, <0.20.0 · fixed in 0.20.0

DigiDoc improper signature verification

• libdigidocpp
• DigiDoc4
• Weak cryptography or TLS

Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack

• zephyr
• Weak cryptography or TLS

hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins

• hyper-mcp
• Weak cryptography or TLS

mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant

• punkpeye mcp-remote
• Weak cryptography or TLS

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

• Information disclosure
• Weak cryptography or TLS

<2.4.0 · fixed in 2.4.0

MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure

• MariaDB server
• Weak cryptography or TLS

Docker Desktop for Windows installer failed to verify external packages

• Docker Desktop
• Weak cryptography or TLS

Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop

• Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module
• Weak cryptography or TLS

Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x

• Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module
• Weak cryptography or TLS

Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signature

• Super Payments
• Weak cryptography or TLS

Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

• Apache Software Foundation Apache CXF
• Weak cryptography or TLS

Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

• Apache Software Foundation Apache CXF
• Weak cryptography or TLS

Improper certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager

• Dell Secure Connect Gateway (SCG) Policy Manager
• Weak cryptography or TLS

Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WB

• TP-Link Systems Inc. Tapo C325WB v2
• Weak cryptography or TLS

Microsoft Partner Center Elevation of Privilege Vulnerability

• Microsoft Partner Center
• Weak cryptography or TLS

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

• Weak cryptography or TLS
• CWE-20

<6.3.1 · fixed in 6.3.1

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

• Weak cryptography or TLS

>=6.2.0, <6.3.0 · fixed in 6.3.0

fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

• Weak cryptography or TLS

>=6.2.4, <6.3.0 · fixed in 6.3.0

Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql

• banq jivejdon
• Weak cryptography or TLS

IBM Guardium Data Protection is affected by multiple vulnerabilities

• IBM Guardium Data Protection
• Weak cryptography or TLS

Mechanize sends credential headers to a different scheme or port after a redirect

• sparklemotion mechanize
• Information disclosure
• Weak cryptography or TLS

@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports

• @fastify/reply-from
• Weak cryptography or TLS

AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

• Weak cryptography or TLS

>=3.0.0, <3.0.12 || >=2.0.0, <2.16.1 · fixed in 3.0.12, 2.16.1

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

• Weak cryptography or TLS
• Hard-coded credentials

>=3.0.0, <3.0.12 || >=2.0.0, <2.16.1 · fixed in 3.0.12, 2.16.1

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

• Weak cryptography or TLS
• Hard-coded credentials

>=3.0.0, <3.0.13 || >=2.0.0, <2.16.1 · fixed in 3.0.13, 2.16.1

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

• Weak cryptography or TLS
• Hard-coded credentials

>=3.0.0.Beta1, <3.0.13 || >=2.0.0, <2.16.1 · fixed in 3.0.13, 2.16.1

FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts

• FFmpeg
• Weak cryptography or TLS

IBM DataPower Gateway Improper Verification of Cryptographic Signature

• IBM DataPower Gateway 10.6CD
• IBM DataPower Gateway 10.6.0
• Weak cryptography or TLS

IBM DataPower Gateway Improper Verification of Cryptographic Signature

• IBM DataPower Gateway 10.6CD
• IBM DataPower Gateway 10.6.0
• Weak cryptography or TLS

World-accessible IPC shared memory with predictable name in TightVNC Server

• GlavSoft TightVNC
• Weak cryptography or TLS
• Broken access control

Improper Certificate Validation in hMailServer

• Progressive Robot Ltd hMailServer
• Weak cryptography or TLS

Cleartext Transmission of Sensitive Information in hMailServer

• Progressive Robot Ltd hMailServer
• Weak cryptography or TLS

Improper certificate validation in Brocade Active Support Connectivity Gateway

• Brocade Active Support Connectivity Gateway
• Weak cryptography or TLS

Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash

• Booking Calendar
• Weak cryptography or TLS

GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) instead of a BIT STRING.

• Weak cryptography or TLS

In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked.

• Weak cryptography or TLS

GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING.

• Weak cryptography or TLS

AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT

• AsyncHttpClient async-http-client
• Weak cryptography or TLS
• Hard-coded credentials

Docker Engine insecure-registry fallback via malicious DNS responses

• Docker Engine
• Moby
• Weak cryptography or TLS

Cisco License On-Prem Security Hardening Release

• Cisco License On-Prem
• Weak cryptography or TLS

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

• Authentication bypass
• Weak cryptography or TLS

<4.6.78 · fixed in 4.6.78

Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade

• Red Hat build of Keycloak 26.6.8
• Red Hat Single Sign-On 7
• Weak cryptography or TLS

Authenticated Local Missing Integrity Verification Vulnerability leads to Local Privilege Escalation in the ClearPass Policy Manager Windows Client Software

• Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)
• Weak cryptography or TLS

Improper certificate validation in Dell System Update

• Dell System Update
• Weak cryptography or TLS

Payload: Password hashes use insufficient PBKDF2 iterations

• Weak cryptography or TLS

>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

• Weak cryptography or TLS

<2.4.20 || >=2.5.0, <2.5.11 || >=2.6.0, <2.6.1 · fixed in 2.4.20, 2.5.11, 2.6.1

Insufficiently random values in Dell Container Storage Modules

• Dell Container Storage Modules
• Weak cryptography or TLS

Improper certificate validation in Dell Container Storage Modules (CSM)

• Dell Container Storage Modules (CSM)
• Weak cryptography or TLS

Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds

• Weak cryptography or TLS

>=0.7.0, <1.0.0-alpha.0 · fixed in 1.0.0-alpha.0

Improper Verification of Cryptographic Signature in Boot

• Qualcomm, Inc. Snapdragon
• Weak cryptography or TLS

Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier

• laurent22 joplin
• Authentication bypass
• Weak cryptography or TLS

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

• Weak cryptography or TLS

<1.1.35 · fixed in 1.1.35

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

• Weak cryptography or TLS

<0.26.2 · fixed in 0.26.2

Langflow: Weak Fernet Key via random.seed()

• Weak cryptography or TLS
• CWE-228

<1.10.1 · fixed in 1.10.1

Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP

• Chainguard Academy (edu)
• Weak cryptography or TLS