Weak cryptography or TLS.

MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs

• MongoDB, Inc. Compass
• Weak cryptography or TLS

Tenda F6 Web Management cleartext transmission

• Tenda F6
• Weak cryptography or TLS
• CWE-310

DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing

• zephyr
• Weak cryptography or TLS

Improper certificate validation in node

• node
• Weak cryptography or TLS

Insufficiently random values in node

• node
• Weak cryptography or TLS

Improper certificate validation in node

• node
• Weak cryptography or TLS

Improper certificate validation in node

• node
• Weak cryptography or TLS

Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

• intranda goobi-viewer-core
• Weak cryptography or TLS
• CWE-340

Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

• intranda goobi-viewer-core
• Weak cryptography or TLS
• CWE-340

XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key

• flatpak xdg-desktop-portal
• Weak cryptography or TLS
• CWE-337

WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers

• Weak cryptography or TLS

>=1.9.0, <1.29.0 · fixed in 1.29.0

JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)

• Eclipse Foundation Eclipse KeyPont - GOSE
• Weak cryptography or TLS
• CWE-20

Use of Unsalted MD5 Password Hashes in CGM CLININET

• CGM CLININET
• Weak cryptography or TLS

InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information

• InterSystems IRIS for Health
• Weak cryptography or TLS

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs

• lxc incus
• Weak cryptography or TLS

OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack

• schorschii OCO-Server
• Weak cryptography or TLS

PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery

• Weak cryptography or TLS

<2.14.0 · fixed in 2.14.0

subhajitkhan online-clinic-management-system patientregistration.php missing encryption

• subhajitkhan online-clinic-management-system
• Weak cryptography or TLS
• CWE-310

Improper certificate validation in OpenVPN 3 Core Library

• OpenVPN 3 Core Library
• Weak cryptography or TLS

Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)

• HCL Software AppScan Integration with Azure Boards for ASoC & A360
• Weak cryptography or TLS

NewType Infortech｜NT OneAPP - Improper Certificate Validation

• NewType Infortech NT OneAPP
• Weak cryptography or TLS

Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

• traefik
• Weak cryptography or TLS

Linksys RE6250 Web Management strcmp random values

• Linksys RE6250
• Weak cryptography or TLS
• CWE-310

Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130

• Drupal Monobank payment API
• Weak cryptography or TLS

SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142

• Drupal SAML SSO - Service Provider
• Weak cryptography or TLS

SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145

• Drupal SAML SSO - Service Provider
• Weak cryptography or TLS

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

• Drupal Cloud
• Weak cryptography or TLS

Broken or risky cryptographic algorithm in Oracle Corporation Oracle Java SE and others

• Oracle Corporation Oracle Java SE
• Oracle Corporation Oracle GraalVM for JDK
• Weak cryptography or TLS

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Weak cryptography or TLS

Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement

• Apache Software Foundation Apache Traffic Server
• Weak cryptography or TLS

Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin

• Apache Software Foundation Apache Traffic Server
• Weak cryptography or TLS

Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role

• Apache Software Foundation Apache Pulsar
• Weak cryptography or TLS

Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure

• Girafit camera app
• Weak cryptography or TLS
• Hard-coded credentials

Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names

• Apache Software Foundation Apache bRPC
• Weak cryptography or TLS

Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token

• Booking Package
• Weak cryptography or TLS

FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation

• FreeRDP
• Weak cryptography or TLS

Improper certificate validation in Oracle Corporation Oracle Java SE and others

• Oracle Corporation Oracle Java SE
• Oracle Corporation Oracle GraalVM for JDK
• Weak cryptography or TLS

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates

• Weak cryptography or TLS

Improper signature verification in Google Chrome

• Google Chrome
• Weak cryptography or TLS

Insufficiently random values in Google Chrome

• Google Chrome
• Weak cryptography or TLS

Improper certificate validation in Google Chrome

• Google Chrome
• Weak cryptography or TLS

Improper signature verification in Totolink

• Totolink
• Weak cryptography or TLS

wolfSSL public-key pinning bypass

• curl
• Weak cryptography or TLS

knownhost callback mismatches key as missing

• curl
• Weak cryptography or TLS

redirect to SFTP or SCP bypasses host verification

• curl
• Weak cryptography or TLS

War Thunder Account Impersonation

• Gaijin Entertainment War Thunder
• Weak cryptography or TLS

uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

• Weak cryptography or TLS

<0.13.4 · fixed in 0.13.4

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component

• Mozilla Firefox
• Mozilla Thunderbird
• Weak cryptography or TLS

Eclipse ioFog operator WebSocket accepts an unverified JWT

• Eclipse Foundation Eclipse ioFog
• Weak cryptography or TLS

Missing encryption of sensitive data in Advantech ADAM-3600

• Advantech ADAM-3600
• Weak cryptography or TLS

TYPO3-EXT-SA-2026-033: Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

• Weak cryptography or TLS
• Broken access control

<5.0.10 || >=6.0.0, <6.0.6 · fixed in 5.0.10, 6.0.6

IBM Cloud Pak System Risky Cryptographic Algorithm

• IBM Cloud Pak System
• Weak cryptography or TLS

IBM Concert Software Improper Certificate Validation

• IBM Concert
• Weak cryptography or TLS

IBM Concert Software Use of Insufficiently Random Values

• IBM Concert
• Weak cryptography or TLS

IBM Concert Software Risky Cryptographic Algorithm

• IBM Concert
• Weak cryptography or TLS

AIOHTTP: Secure attribute not enforced for shared cookie

• Weak cryptography or TLS
• CWE-1004

<3.14.4 · fixed in 3.14.4

A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request

• Weak cryptography or TLS

>=0.34.0-beta.1, <0.64.0 · fixed in 0.64.0

Missing encryption of sensitive data in Dell Application Installer,

• Dell Application Installer,
• Weak cryptography or TLS

TufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validation

• TufayelLUS TikTok-Video-Downloader-PHP
• Authentication bypass
• Weak cryptography or TLS

Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore

• Apache Software Foundation Apache Camel
• Weak cryptography or TLS