CVE-2026-74882

The PHP package openssl_encrypt before version 1.4.0 ships with an insecure default that trusts the entire RFC 1918 private address space in IntegrityProxyConfig::trusted_proxies. An attacker on a private network can forge client certificate headers to bypass mTLS authentication whenever ProxyAut...

CVE-2026-74880

The openssl_encrypt package (before 1.4.0) accepts refresh tokens as URL query parameters in its keyserver and telemetry server routes. Because URLs are logged in server logs, proxy logs, browser history, and HTTP Referer headers, attackers can extract these tokens to gain unauthorized access. Th...

CVE-2026-74881

The PHP package openssl_encrypt (jahlives) before 1.4.0 sets CORS allow_origins to wildcard while allow_credentials is true, violating CORS spec. Attackers can lure authenticated users to malicious sites that issue authenticated cross-origin API requests, exposing data. No in-the-wild exploitatio...

CVE-2026-74879

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint of openssl_encrypt_server/server.py (lines 159–175). The endpoint catches database exceptions and returns the full exception string via str(e) in the HTTP response to unauthenticated calle...

CVE-2026-74878

openssl_encrypt versions before 1.4.0 contain a TOTP brute-force rate limiter bypass in openssl_encrypt_server/modules/pepper/totp.py. The TOTPRateLimiter class stores attempt and lockout state in an in-memory defaultdict(list) as a class variable, meaning rate-limit state is not shared across wo...

CVE-2026-74877

openssl_encrypt versions before 1.4.0 contain a missing ownership verification flaw in the revoke_key method (keyserver/service.py, lines 195–270). The method accepts a client_id parameter but never verifies it matches key.owner_client_id, allowing any authenticated client to revoke another clien...

CVE-2026-74876

In openssl_encrypt before 1.4.0, PublicKeyBundle.from_dict() accepts untrusted key bundle data without signature verification. Attackers can craft a malicious bundle, call to_identity(), and encrypt secrets to an attacker-controlled public key, enabling confidential data exfiltration. CVSS 9.8 cr...

CVE-2026-74875

openssl_encrypt (Python package) before 1.4.0 silently skips JSON schema validation when the optional jsonschema library is absent, allowing attackers to remove that package or supply unknown metadata format versions to bypass all schema checks and process malicious data (CVSS 9.8 CRITICAL). No i...

CVE-2026-74874

openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module (Mersenne Twister) for steganographic pixel selection in the generate_pseudorandom_sequence() function (openssl_encrypt/plugins/steganography/core/utils.py, lines 89–91). The Mersenne Twister state is recoverable f...

CVE-2026-74873

The openssl_encrypt tool (before v1.4.0) passes --password values as visible process arguments, retrievable by any local user via ps aux or /proc/[pid]/cmdline, exposing plaintext and keystore passwords. CVSS 5.5 (local) / 8.7 (network). Upgrade to v1.4.0 or pass passwords via stdin/env instead o...

CVE-2026-74872

The Python package openssl_encrypt before version 1.4.0 loads native .so modules via a broad glob pattern (whirlpool*py313*.so) without integrity checks, allowing arbitrary code execution. Attackers placing malicious .so files in site-packages trigger native code execution on module load. Fixed i...

CVE-2026-74871

The jahlives/openssl_encrypt PHP package before 1.4.6 has a KDF bypass: in sequential XOR composition mode the final stage cancels out, so attackers with local access can crack passwords at SHA-256 speed instead of the configured memory-hard KDF cost. CVSS 6.2 (MEDIUM, local). No in-the-wild expl...

CVE-2026-74870

openssl_encrypt (pip) versions

CVE-2026-74869

StoatChat before version 0.15.0 has a missing-authorization flaw in the Subscribe message handler: authenticated users can send a Subscribe message with any arbitrary server ID and receive live UserUpdate events (display names, avatars, status) for members of private servers they are not part of....

CVE-2026-74868

SiYuan before 3.7.4 has an unthrottled brute-force flaw in PublishServiceTransport.RoundTrip() (kernel/server/proxy/publish.go), where the Publish Service (default TCP 6808) applies Basic Auth with no rate limiting, lockout, or backoff, letting unauthenticated remote attackers guess passwords aga...

CVE-2026-74802

SiYuan versions before 3.7.4 set the WebSocket CheckOrigin handler to unconditionally return true on the admin-only /ws/network/proxy endpoint, allowing cross-site WebSocket hijacking. A malicious webpage can make the victim's SiYuan kernel proxy arbitrary network traffic, enabling authenticated ...

CVE-2026-74867

SiYuan versions before 3.7.4 are affected by a cross-site request forgery (CSRF) vulnerability in the session-cookie authentication branch of CheckAuth() . The root cause is the absence of Origin/Referer header validation combined with the lack of an explicit SameSite attribute on session cookies...

CVE-2026-74801

SiYuan before 3.7.4 fails to escape workspace directory paths passed to the elevated elevator.exe helper. An attacker can create a directory containing command metacharacters, then trigger the Microsoft Defender exclusion flow to execute arbitrary commands as administrator after UAC approval. CVS...

CVE-2026-74800

SiYuan before v3.7.4 serves uploaded HTML files without Content-Disposition or X-Content-Type-Options headers, enabling authenticated attackers to inject stored XSS that runs with full kernel API access when the workspace owner clicks the asset link; upgrade to v3.7.4 or later. No active exploita...

CVE-2026-74799

SiYuan (note-taking app) before version 3.7.4 registers Go net/http/pprof debug endpoints (e.g., /debug/pprof/heap, goroutine dumps) without authentication whenever the --mode flag is not exactly prod. An unauthenticated network attacker can request these endpoints to extract in-memory secrets, i...