CVE-2026-81702

opensslencrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling...

PYSEC-2026-3962

opensslencrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling...

PT-2026-82603

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to re-derive and validate fingerprints when loading identities from the identity.json file. This allows attackers to substitute legitimate public keys in identity stores wi...

Duplicate Advisory: SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fwg2-gr34-q3w8. This link is maintained to preserve external references. Original Description SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM...