13843 matches found
Use of a Broken or Risky Cryptographic Algorithm
Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...
CVE-2026-59650
A flaw was found in Bouncy Castle for Java. The software fails to validate Diffie-Hellman peer values during key agreement. A remote attacker can exploit this flaw to compromise cryptographic keys, potentially leading to the decryption of sensitive communications or successful impersonation...
PYSEC-2026-3772
opensslencrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain...
PYSEC-2026-3772
opensslencrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain...
PYSEC-2026-3745
opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module Mersenne Twister PRNG at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that...
PYSEC-2026-3745
opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module Mersenne Twister PRNG at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that...
PYSEC-2026-3754
opensslencrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generatepseudorandomsequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations...
CVE-2026-74900 openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode
opensslencrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain...
CVE-2026-74889 openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF
opensslencrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks...
CVE-2026-74889 openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF
opensslencrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks...
EUVD-2026-60108
opensslencrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks...
CVE-2026-74887
The openssl_encrypt package (versions before 1.4.0 ) is vulnerable because the pqc module imports Python's non-cryptographic random module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. While no cryptographic operations are currently affected by direct calls to this module,...
Important: dotnet9.0
Issue Overview: Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47303 Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-74876: Improper Verification of Cryptographic Signature
opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...
CVE-2026-51977: Use of Hard-coded Cryptographic Key
An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component...
The vulnerability of the Apache Tomcat application server, related to the use of cryptographic algorithms containing vulnerabilities, allows attackers to alter the order of preference for encryption.
The vulnerability of the Apache Tomcat application server is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability allows a remote attacker to alter the encryption preferences...
CVE-2026-18500: Improper Verification of Cryptographic Signature
@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify key is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different...
Linux Distros Unpatched Vulnerability : CVE-2026-74438
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: sun4i-ss - Remove insecure and unused rngalg Remove sun4issrng, as it is insecure and unused: - It has multiple vulnerabilities. sun4issprngseed is...
