CVE-2026-50086

The Aqara IAM/SSO gateway gw-builder.aqara.com exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has a...

UBUNTU-CVE-2026-47372

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography...

CVE-2026-5682 Meesho Online Shopping App com.meesho.supply endpoint risky encryption

A vulnerability has been found in Meesho Online Shopping App up to 27.3 on Android. Affected is an unknown function of the file /api/endpoint of the component com.meesho.supply. Such manipulation leads to risky cryptographic algorithm. The attack may be performed from remote. The attack requires ...

librnp: Weak random number generation

Background librnp is a high performance C++ OpenPGP library. Description The affected librnp version generated weak session keys for its public key encryption PKESK mode. Impact Messages encrypted using the affected librnp version might be readable by an attacker with just the public key...

CVE-2025-21062

The vulnerability CVE-2025-21062 affects Samsung Smart Switch, prior to version 3.7.67.2. The issue stems from use of a broken or risky cryptographic algorithm in the restoration process, allowing local attackers to replace the restoring application. Exploitation requires user interaction. Impact...

CVE-2025-9828

A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub2B7D04 of the component uhttp. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. This attack is characterized by high complexity. The exploitabili...

PT-2025-35587

Name of the Vulnerable Software and Affected Versions: Tenda CP6 version 11.10.00.243 Description: A vulnerability exists in the function sub 2B7D04 of the uhttp component. Manipulation of this function can lead to a risky cryptographic algorithm. This attack can be launched remotely and is...

ALPINE-CVE-2025-23166

The C++ method SignTraits::DeriveBits may incorrectly call ThrowException based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary...

DEBIAN-CVE-2019-9898

Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71...