PYSEC-2026-3794

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

PYSEC-2026-3794

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

CVE-2026-81686

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

EUVD-2026-67060

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81704 openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81704 openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81704

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler. The affected code uses unstretched SHA-256 instead of Argon2id , omitting key stretching and hash rounds. This allows attackers to perform offline password guessing ag...

CVE-2026-81704 openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81686 openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

CVE-2026-81686

openssl_encrypt 1.4.x before 1.4.9 ships an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can set MaxConcurrentOperations to 0/negative (blocking all subsequent op...

CVE-2026-81686 openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

EUVD-2026-67042

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

CVE-2026-81686 openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

CVE-2026-81686: Improper Input Validation

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

PT-2026-82587

openssl encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

CVE-2026-81704: Use of Password Hash With Insufficient Computational Effort

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

PT-2026-82605

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The D-Bus CryptoService.EncryptFile handler uses unstretched SHA-256 instead of Argon2id for key derivation. This allows attackers to perform offline password guessing against encrypted files...

SUSE CVE-2026-61898

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

Unity Linux 20.1060a / 20.1070a Security Update: abrt (UTSA-2026-104827)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104827 advisory. A time-of-check time-of-use TOCTOU race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event...

CentOS 9 : glib2-2.68.4-29.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the glib2-2.68.4-29.el9 build changelog. - heap under-read in gkeyfilegetlocalestringlist CVE-2026-58014 - limit D-Bus auth line read length CVE-2026-15588 - off-by-one error in...