CVE-2026-74876

creationtimestamp| type| source ---|---|--- 2026-08-17 12:08:09+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtbo4tfpct2p 2026-08-17 15:02:17+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtbxugdhwh2l 2026-08-17 15:03:37+00:00| seen|...

CVE-2026-74876

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

CVE-2026-74876

In openssl_encrypt before 1.4.0, PublicKeyBundle.from_dict() accepts untrusted key bundle data without signature verification. Attackers can craft a malicious bundle, call to_identity(), and encrypt secrets to an attacker-controlled public key, enabling confidential data exfiltration. CVSS 9.8 cr...