CVE-2026-81706

opensslencrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes...

CVE-2026-81707

opensslencrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows o...

CVE-2026-81702

opensslencrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling...

EUVD-2026-67063

opensslencrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows o...

CVE-2026-81707

openssl_encrypt versions before 1.4.9 fail to sanitize the email field in imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed in the terminal. The attack can be delivered through normal contact-exchange flows or ke...

CVE-2026-81706 openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing

opensslencrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes...

EUVD-2026-67062

opensslencrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes...

CVE-2026-81706

openssl_encrypt before 1.4.9 is vulnerable to key substitution via identity shadowing . The root cause lies in IdentityStore , which fails to prevent namespace collisions between a user's own identities and contacts. An attacker can create shadowed contact entries that remain invisible until the ...

EUVD-2026-67058

opensslencrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling...

CVE-2026-81702

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, enabling silent key substitution . An attacker can replace legitimate public keys in identity stores with their own while maintaining the claimed fingerprint, so that encryption u...

CVE-2026-47192

kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the...

Security of iMessage System Comes to the Fore Again

The iMessage system, like much of what Apple does, is mostly a black box. The company doesn’t talk much about how the system works, and although some security researchers found a couple years ago that Apple could read users’ encrypted messages if they so choose, law enforcement has had no luck in...