Search
Search Results (66 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-74882 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-31 | 7.5 High |
| openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified. | ||||
| CVE-2026-74887 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-31 | 3.7 Low |
| openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0. | ||||
| CVE-2026-74892 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-31 | 7.5 High |
| openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication. | ||||
| CVE-2026-74899 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-28 | 9.8 Critical |
| openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands. | ||||
| CVE-2026-74871 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-21 | 6.2 Medium |
| openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password cracking at SHA-256 speed instead of the configured KDF cost. | ||||
| CVE-2026-74881 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-21 | 6.5 Medium |
| openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them. | ||||