CVE-2026-81705

openssl-encrypt versions before 1.4.9 fail to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g., -apHunter2) or abbreviated long-option spellings (e.g., --passw). The sanitizer only recognized exact option names, --option=valu...

CVE-2026-81705 openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings e.g. -apHunter2 or abbreviated long-option spellings e.g. --passw. The sanitizer only recognized exact option names, --option=value forms, and...

EUVD-2026-67061

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings e.g. -apHunter2 or abbreviated long-option spellings e.g. --passw. The sanitizer only recognized exact option names, --option=value forms, and...

CVE-2026-81697

The openssl-encrypt PyPI package (versions ≤ 1.4.8) contains a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE—originally set to the absolute per-user path ~/.crypt_settings.json—is reassigned at line 84 to the bare relative name crypt_settings.json. The le...

EUVD-2026-67053

opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...

CVE-2026-81694 verify-usb before 1.4.9 Output Injection via Unsanitized Filenames

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

CVE-2026-81694

openssl-encrypt (pip package, versions ≤ 1.4.8) is vulnerable to output injection in the verify-usb command. Filenames read from untrusted drive data—residing outside the AES-GCM authenticated manifest —are printed without sanitization, allowing an attacker to plant terminal cursor-movement and e...

EUVD-2026-67050

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

CVE-2026-81694 verify-usb before 1.4.9 Output Injection via Unsanitized Filenames

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

CVE-2026-81690 verify-usb before 1.4.9 Symlink Directory Traversal Code Execution

openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while ONOFOLLOW on the...

EUVD-2026-67046

openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while ONOFOLLOW on the...

CVE-2026-81690

openssl-encrypt (pip package) versions before 1.4.9 contain a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The vulnerability arises because rglob() in CPython does not descend into symlinked directories, while O_NOFOLLOW on the hash side binds only the final path compone...

CVE-2026-81690 verify-usb before 1.4.9 Symlink Directory Traversal Code Execution

openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while ONOFOLLOW on the...

EUVD-2026-67040

In opensslencrypt pip package openssl-encrypt versions /cmdline for the lifetime of the subprocess. Fixed in 1.4.9...

CVE-2026-81684

openssl_encrypt (pip package openssl-encrypt) versions ≤ 1.4.8 contain an information disclosure flaw in its desktop GUI. The steganography password is passed to a CLI child process via the --stego-password command-line argument (on both encrypt and decrypt paths) rather than through an environme...

CVE-2026-81683 openssl_encrypt before 1.4.9 Plaintext Private Key Storage

opensslencrypt pip package openssl-encrypt versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable 0644 SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access...

CVE-2026-81683

CVE-2026-81683 affects the openssl_encrypt Python package (pip name openssl-encrypt) versions 1.4.8 and earlier . The vulnerability is in the desktop GUI's Settings screen, where a "combined certificate and private key" PEM field stores an mTLS client private key in cleartext within a world-reada...

EUVD-2026-67039

opensslencrypt pip package openssl-encrypt versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable 0644 SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access...

CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage

opensslencrypt pip package openssl-encrypt versions = 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption k...

PT-2026-82602

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software uses a denylist to identify trusted built-in plugins, which allows unsigned plugins located in top-level plugins/ directories and unknown subdirectories to bypass signature...