CVE-2026-81717: Improper Verification of Cryptographic Signature

opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...

CVE-2026-81714: Improper Verification of Cryptographic Signature

opensslencrypt pip: openssl-encrypt versions = 1.4.8 use suffix-tolerant fingerprint matching in enrolltrustkey when binding a plugin-signing trust anchor. An operator who confirms a short forgeable, 32-bit GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which...

CVE-2026-81701: Improper Verification of Cryptographic Signature

opensslencrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths...

CVE-2026-81680: Improper Verification of Cryptographic Signature

opensslencrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Attackers can modify the file header to delete recovery-slot fields and bypass authentication, silent...

CVE-2026-76784 Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices

Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful...

CVE-2026-16599

A flaw was found in wget's FTP OPIE/S-KEY authentication functionality. A malicious FTP server or a network attacker can send a specially crafted OPIE challenge. This challenge contains a sequence number that, when processed by wget, can lead to an excessive number of cryptographic computations...

Improper Cryptographic Verification

Bouncy Castle is vulnerable to Improper Cryptographic Verification. The vulnerability is due to the KCCMBlockCipher MAC not binding the nonce when no Additional Authenticated Data AAD is present, which allows an attacker to forge authenticated ciphertexts across different nonces...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in Magneto component

Summary IBM Integrated Analytics System includes Magneto as an internal resource manager component. CVE-2025-36271 affects the resmgr.py module in Magneto, where a predictable salt value is used in cryptographic operations. The use of a predictable salt weakens the effectiveness of hashing and...

PT-2026-82235

Name of the Vulnerable Software and Affected Versions TP-Link Kasa affected versions not specified Description Multiple smart home devices have insufficient cryptographic protections in the local device communication protocol. An attacker on the same network can intercept, replay, or forge locall...

CVE-2026-76784: Missing Cryptographic Step

Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful...

CVE-2026-79084

Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

Improper Verification Of Cryptographic Signature

Bouncy Castle is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to OpenPGP AEAD decryption failing to verify the final authentication tag for chunk-aligned data, which allows an attacker to modify encrypted data without detection and potentially bypass...

CVE-2026-24166

NVIDIA UFM Enterprise has a vulnerability in its session management component caused by a hard-coded cryptographic key . An attacker with local access could exploit this to extract information, potentially leading to information disclosure and escalation of privileges . The CVSS 3.1 score is 5.1 ...

Security update for librest

This update for librest fixes the following issue: CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-random number generator bsc1272399. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Grok fooled into stealing user chat, location data, and more

A new type of prompt injection attack shows why giving AI assistants access to browsers, code tools, and private data deserves extra caution. AI researchers describe "Cryptographic Context Injection"—an attack that hides malicious instructions inside encrypted data. The AI is then persuaded to...

SeriCrypt: An LLM-Driven Context-Aware Serialization Framework for Cryptographic Protocols

Constructing syntactically correct and cryptographically valid message sequences is essential for protocol state machine learning, conformance testing, and fuzzing. Unlike plaintext protocols, cryptographic protocols involve complex cross-message state dependencies and cryptographic computation...

Automotive HSMs - Architectural Challenges and Security Implications

Automotive electronic control units ECUs increasingly depend on hardware-rooted security to protect software integrity, authenticity, and lifecycle management in the presence of remote and physical threats. Hardware Security Modules HSMs have become a key building block in automotive...

CVE-2026-24166: Use of Hard-coded Cryptographic Key

NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract information. A successful exploit of this vulnerability might lead to information disclosure and escalation of privileges...

The vulnerability of the f81604_read_int_callback() function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver allows a hacker to induce a system failure.

The vulnerability of the f81604readintcallback function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver relates to the possibility of modifying the contents of a publicly accessible static array. Exploiting this vulnerability could allow an attack...

The vulnerability of the x509_process_extension() function in the crypto/asymmetric_keys/x509_cert_parser.c module of the Linux kernel’s cryptographic subsystem allows a attacker to compromise the confidentiality and accessibility of the protected information.

The vulnerability of the x509processextension function in the crypto/asymmetrickeys/x509certparser.c module of the Linux kernel’s cryptographic subsystem is related to the execution of operations outside of the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to...