CVE-2026-74888

The PHP package openssl_encrypt before 1.4.0 uses a non-standard PBKDF2 construction (iterations=1 per call) that weakens key derivation, enabling attackers to more efficiently crack passwords protecting legacy encrypted files. No in-the-wild exploitation is reported; upgrading to version 1.4.0 i...

CVE-2026-74888 openssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key Derivation

opensslencrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords...

CVE-2026-74876 openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

BIT-MONGODB-2026-13069 Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability fo...

BIT-MONGODB-2026-13062 MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...

CVE-2026-74889: Inadequate Encryption Strength

opensslencrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks...

PT-2026-73381

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...

PT-2026-73388

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability fo...

PT-2026-76612

openssl encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from dict that creates key bundles from untrusted data without verifying signatures. Attackers can call from dict followed by to identity without signature verification to encrypt data using attacker-controlled publi...

The vulnerability of the Apache Tomcat application server, related to the use of cryptographic algorithms containing vulnerabilities, allows attackers to alter the order of preference for encryption.

The vulnerability of the Apache Tomcat application server is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability allows a remote attacker to alter the encryption preferences...

CVE-2026-19891

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...

CVE-2026-19891

CVE-2026-19891 affects TRENDnet TEW-WLC100 firmware (version 2.05b02) and involves an issue in the IKE Phase 1 Aggressive Mode component, specifically the /etc/racoon.conf function. The attacker can remotely manipulate the exchange_mode argument, resulting in missing encryption of sensitive data....

EUVD-2026-59607

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...

CVE-2026-19891 TRENDnet TEW-WLC100 IKE Phase 1 Aggressive Mode racoon.conf missing encryption

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...

PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext

...

CVE-2026-19891: Missing Encryption of Sensitive Data

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...

PT-2026-72886

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-WLC100 version 2.05b02 Description An issue exists in the IKE Phase 1 Aggressive Mode component within the /etc/racoon.conf file. Manipulation of the exchange mode argument leads to a failure in encrypting sensitive data. This fla...

GO-2026-5426 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr, grafana-mimir, k6, kubernetes-csi-external-provisioner, temporal, cortex, gitness, ferretdb, kwok, istio, helm-operator, kaniko, gogatekeeper, guac, cluster-api, harbor-registry, kuma, sftpgo-plugin-pubsub, verticadb-operator, envoy-gateway,...

GO-2024-2824 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-provisioner, cortex, git-lfs, ferretdb, gitness, kwok, newrelic-nri-statsd, gobump, helm-operator, mkcert, ctop, guac, harbor-registry, go-bindata, crossplane-provider-azure, s5cmd, docker-credential-acr-env, sonobuoy, petname, step-ca, k3d,...

Malicious code in webautomation_js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 854e679284d7396f5ac4f7248839fa3704a2c72bcec08c100267b5980cd2a0d5 index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported function appends a...