CVE-2026-18104 | Low | 3.3 | 2026-09-24 | IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode fo… |
CVE-2026-82356 | High | 7.5 | 2026-09-23 | Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely f… |
CVE-2026-18153 | Medium | 5.4 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information and forge authenticati… |
CVE-2025-36084 | Medium | 5.9 | 2026-09-22 | IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
CVE-2026-54147 | Medium | 6.5 | 2026-09-18 | http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ign… |
CVE-2025-33147 | Medium | 5.9 | 2026-09-18 | IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information cause… |
CVE-2024-56344 | Medium | 5.9 | 2026-09-18 | IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the fail… |
CVE-2026-81438 | Low | 3.7 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated a… |
CVE-2025-36591 | Medium | 4.4 | 2026-09-16 | Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Use of a Broken or Risky Cryptographic Algorithm vulnera… |
CVE-2026-15638 | | | 2026-09-16 | An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. T… |
CVE-2026-11929 | High | 7.5 | 2026-09-15 | IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data. |
CVE-2026-17467 | High | 8.2 | 2026-09-14 | IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attacker to obtain sensitive information due to the use of weak or deprecated cryptog… |
CVE-2026-81822 | High | 8.4 | 2026-09-08 | The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords… |
CVE-2026-69382 | Medium | 5.9 | 2026-09-08 | Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network. |
CVE-2026-16693 | Medium | 4.4 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to the use of hardcoded cryptographic constants to… |
CVE-2026-81859 | Medium | 6.2 | 2026-09-04 | CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken or risky cryptographic algorithm. |
CVE-2026-76133 | Critical | 9.8 | 2026-08-31 | The affected Ebyte
product
uses a deprecated hashing algorithm in an authentication-related
operation. Under conditions where an attacker can manipulate or… |
CVE-2026-39944 | High | 8.8 | 2026-08-28 | Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway (RGW)… |
CVE-2025-30156 | High | 8.9 | 2026-08-28 | Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication… |
CVE-2026-78236 | High | 8.8 | 2026-08-26 | An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communicat… |
CVE-2026-77151 | Low | 3.7 | 2026-08-20 | A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go… |
CVE-2026-74888 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose s… |
CVE-2026-27871 | | | 2026-08-14 | Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack.
This issue affects TL280: before… |
CVE-2026-16459 | | | 2026-08-13 | Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to r… |
CVE-2026-16458 | | | 2026-08-13 | Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover pla… |
CVE-2026-48386 | High | 7.5 | 2026-08-11 | ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could… |
CVE-2026-66407 | High | 8.1 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication.
The WebSocket private key may be retrieved through analyzin… |
CVE-2026-8470 | High | 7.4 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for ge… |
CVE-2026-56609 | Medium | 4.8 | 2026-08-03 | HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and… |
CVE-2026-67336 | High | 8.7 | 2026-08-01 | better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept pla… |
CVE-2026-65309 | High | 7.5 | 2026-07-31 | ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores
and transmits user passwords using a reversible format instead of a
one-way password hash… |
CVE-2026-56582 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL pa… |
CVE-2026-63761 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS ... TYPE JWT ALGORIT… |
CVE-2026-56454 | Medium | 5.9 | 2026-07-16 | HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographi… |
CVE-2026-15605 | Low | 3.1 | 2026-07-13 | A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil… |
CVE-2026-54780 | Low | 3.7 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, the CoreWCF WS-Security 1.0 receive pip… |
CVE-2026-14742 | Low | 3.1 | 2026-07-05 | A vulnerability was determined in langchain-ai langgraph up to 1.2.4. The affected element is the function _freeze of the file libs/langgraph/langgraph/_intern… |
CVE-2026-14738 | Low | 3.7 | 2026-07-05 | A security flaw has been discovered in exo-explore exo up to 1.0.71. Affected is the function _image_cache_key of the file src/exo/worker/engines/mlx/vision.py… |
CVE-2026-14630 | Low | 3.1 | 2026-07-04 | A vulnerability has been found in ForceInjection AI-fundermentals 2.0/3.0. Affected by this vulnerability is the function get_conversation_history of the file… |
CVE-2026-57997 | Medium | 4.8 | 2026-06-29 | Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance… |
CVE-2026-13510 | Low | 3.7 | 2026-06-28 | A vulnerability was found in SimStudioAI sim up to 0.6.92. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core/security… |
CVE-2026-13482 | Low | 3.7 | 2026-06-28 | A vulnerability was detected in skypilot-org skypilot up to 0.12.0. Impacted is the function username.encode of the file sky/users/server.py of the component U… |
CVE-2026-47775 | Medium | 6.8 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAuth2 HTTP filter's e… |
CVE-2026-9221 | High | 7.5 | 2026-06-26 | The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request signature for authenticating communicatio… |
CVE-2026-6330 | Medium | 6.5 | 2026-06-25 | The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA… |
CVE-2026-6412 | Medium | 4.3 | 2026-06-25 | Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing. |
CVE-2026-50268 | Low | 1.9 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encrypti… |
CVE-2026-40641 | Medium | 4.8 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker… |
CVE-2026-9261 | Medium | 6.8 | 2026-06-16 | Use of weak SSH cryptographic algorithms in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-50086 | Critical | 10.0 | 2026-06-12 | The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an in… |
CVE-2026-40996 | Medium | 4.8 | 2026-06-11 | Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Secu… |
CVE-2025-10237 | Medium | 6.7 | 2026-06-10 | During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller firmware that could allow a privileged lo… |
CVE-2026-11481 | Low | 2.5 | 2026-06-08 | A vulnerability was determined in yoanbernabeu grepai up to 0.35.0. The affected element is the function PostgresStore.LookupByContentHash of the file indexer/… |
CVE-2026-11479 | Medium | 4.2 | 2026-06-08 | A vulnerability has been found in yoanbernabeu grepai 0.35.0. This issue affects some unknown processing of the file indexer/chunker.go of the component Qdrant… |
CVE-2026-46395 | | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contain… |
CVE-2026-11330 | Low | 3.6 | 2026-06-05 | A weakness has been identified in thedotmack claude-mem up to 11.0.1. The affected element is the function computeObservationContentHash of the file src/servic… |
CVE-2026-11329 | Low | 3.6 | 2026-06-05 | A vulnerability has been found in onnx onnx-mlir up to 0.5.0.0. Affected by this issue is the function generate_hash_key of the file src/Runtime/python/torch_o… |
CVE-2026-10814 | Medium | 4.5 | 2026-06-04 | A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kv_catalog… |
CVE-2026-10813 | Low | 3.6 | 2026-06-04 | A flaw has been found in LMCache up to 0.4.6. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cac… |
CVE-2026-10812 | Low | 3.6 | 2026-06-04 | A vulnerability was detected in zilliztech GPTCache up to 0.1.44. Affected by this issue is the function BufferedReader.peek of the file gptcache/processor/pre… |
CVE-2026-10804 | Low | 3.6 | 2026-06-04 | A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the compon… |
CVE-2026-10803 | Low | 3.6 | 2026-06-04 | A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component… |
CVE-2026-10801 | Low | 3.6 | 2026-06-04 | A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template._save_pil_image of the file swift/template/ba… |
CVE-2026-10800 | Low | 3.6 | 2026-06-04 | A weakness has been identified in PaddlePaddle FastDeploy up to 2.4.1. Affected by this issue is the function hash_features of the file fastdeploy/multimodal/h… |
CVE-2026-10783 | Low | 2.5 | 2026-06-04 | A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Perfor… |
CVE-2026-10766 | Low | 3.6 | 2026-06-03 | A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helper… |
CVE-2026-36609 | High | 7.3 | 2026-06-03 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source I… |
CVE-2026-45701 | | | 2026-06-01 | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.23 and 3.0.6, the password reset tokenand API key ge… |
CVE-2026-49323 | Medium | 4.3 | 2026-05-29 | Weak authentication between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year… |
CVE-2026-49322 | Medium | 4.3 | 2026-05-29 | Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with… |
CVE-2025-46371 | Low | 3.6 | 2026-05-22 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the ssh. A low privileged attacker w… |
CVE-2026-44053 | High | 7.4 | 2026-05-21 | Netatalk 1.5.0 through 4.2.2 uses a broken cryptographic algorithm in the DHCAST128 UAM, which allows a remote attacker to obtain authentication credentials or… |
CVE-2026-8803 | Low | 3.7 | 2026-05-18 | A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the compone… |
CVE-2026-44699 | | | 2026-05-15 | LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS25… |
CVE-2026-8072 | | | 2026-05-12 | Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the… |
CVE-2026-6411 | High | 7.3 | 2026-05-07 | This vulnerability, in the MAXHUB Pivot client application versions
prior to v1.36.2, may allow an attacker to obtain encrypted tenant email
addresses and re… |
CVE-2026-44405 | Low | 3.4 | 2026-05-06 | In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm. |
CVE-2026-7845 | Low | 2.6 | 2026-05-05 | A flaw has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. This issue affects the function PIL.Image.tobytes of the file libs/chatchat-server/ch… |
CVE-2026-7103 | Low | 3.7 | 2026-04-27 | A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file update_user.php of the component MD5 Hash Handler… |
CVE-2026-5926 | Medium | 6.5 | 2026-04-23 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 thr… |
CVE-2026-32959 | Medium | 5.9 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a broken or risky cryptographic algorithm. Information in the traffi… |
CVE-2026-5588 | High | 7.5 | 2026-04-15 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy C… |
CVE-2025-14813 | High | 7.5 | 2026-04-15 | : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).
This vulnerability… |
CVE-2026-29129 | High | 7.5 | 2026-04-09 | Configured cipher preference order not preserved vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51… |
CVE-2025-14859 | | | 2026-04-07 | The Semtech LR11xx LoRa transceivers implement secure boot functionality using digital signatures to authenticate firmware. However, the implementation uses a… |
CVE-2026-5682 | Low | 3.7 | 2026-04-06 | A vulnerability has been found in Meesho Online Shopping App up to 27.3 on Android. Affected is an unknown function of the file /api/endpoint of the component… |
CVE-2026-34950 | Critical | 9.1 | 2026-04-06 | fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that… |
CVE-2025-13916 | Medium | 5.9 | 2026-04-01 | IBM Aspera Shares 1.9.9 through 1.11.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information |
CVE-2026-25834 | Medium | 6.5 | 2026-04-01 | Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade. |
CVE-2019-25651 | High | 8.3 | 2026-03-27 | Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW… |
CVE-2026-33512 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication… |
CVE-2026-28490 | Medium | 6.5 | 2026-03-16 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified… |
CVE-2026-20996 | Medium | 5.3 | 2026-03-16 | Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15 allows remote attackers to configure a downgraded scheme for authen… |
CVE-2026-28252 | Critical | 9.8 | 2026-03-12 | A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authent… |
CVE-2025-41711 | Medium | 5.3 | 2026-03-10 | An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access. |
CVE-2026-28479 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox configurations, which is deprecated and vul… |
CVE-2025-13476 | Critical | 9.8 | 2026-03-05 | Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension dive… |
CVE-2026-3598 | High | 7.5 | 2026-03-05 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro on Windows, MacOS, Linux (Config… |
CVE-2026-30791 | High | 7.5 | 2026-03-05 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebCl… |
CVE-2026-23601 | Medium | 5.4 | 2026-03-04 | A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can generate shared-key authenticated transmi… |