CVE-2026-27871 | | | 2026-08-14 | Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack.
This issue affects TL280: before… |
CVE-2026-16459 | | | 2026-08-13 | Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to r… |
CVE-2026-16458 | | | 2026-08-13 | Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover pla… |
CVE-2026-48386 | High | 7.5 | 2026-08-11 | ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could… |
CVE-2026-66407 | High | 8.1 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication.
The WebSocket private key may be retrieved through analyzin… |
CVE-2026-8470 | High | 7.4 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for ge… |
CVE-2026-56609 | Medium | 4.8 | 2026-08-03 | HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and… |
CVE-2026-67336 | High | 8.7 | 2026-08-01 | better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept pla… |
CVE-2026-65309 | High | 7.5 | 2026-07-31 | ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores
and transmits user passwords using a reversible format instead of a
one-way password hash… |
CVE-2026-56582 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL pa… |
CVE-2026-63761 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS ... TYPE JWT ALGORIT… |
CVE-2026-56454 | Medium | 5.9 | 2026-07-16 | HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographi… |
CVE-2026-15605 | Low | 3.1 | 2026-07-13 | A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil… |
CVE-2026-54780 | Low | 3.7 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, the CoreWCF WS-Security 1.0 receive pip… |
CVE-2026-14742 | Low | 3.1 | 2026-07-05 | A vulnerability was determined in langchain-ai langgraph up to 1.2.4. The affected element is the function _freeze of the file libs/langgraph/langgraph/_intern… |
CVE-2026-14738 | Low | 3.7 | 2026-07-05 | A security flaw has been discovered in exo-explore exo up to 1.0.71. Affected is the function _image_cache_key of the file src/exo/worker/engines/mlx/vision.py… |
CVE-2026-14630 | Low | 3.1 | 2026-07-04 | A vulnerability has been found in ForceInjection AI-fundermentals 2.0/3.0. Affected by this vulnerability is the function get_conversation_history of the file… |
CVE-2026-57997 | Medium | 4.8 | 2026-06-29 | Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance… |
CVE-2026-13510 | Low | 3.7 | 2026-06-28 | A vulnerability was found in SimStudioAI sim up to 0.6.92. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core/security… |
CVE-2026-13482 | Low | 3.7 | 2026-06-28 | A vulnerability was detected in skypilot-org skypilot up to 0.12.0. Impacted is the function username.encode of the file sky/users/server.py of the component U… |
CVE-2026-47775 | Medium | 6.8 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAuth2 HTTP filter's e… |
CVE-2026-9221 | High | 7.5 | 2026-06-26 | The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request signature for authenticating communicatio… |
CVE-2026-6330 | Medium | 6.5 | 2026-06-25 | The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA… |
CVE-2026-6412 | Medium | 4.3 | 2026-06-25 | Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing. |
CVE-2026-50268 | Low | 1.9 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encrypti… |
CVE-2026-40641 | Medium | 4.8 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker… |
CVE-2026-9261 | Medium | 6.8 | 2026-06-16 | Use of weak SSH cryptographic algorithms in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-50086 | Critical | 10.0 | 2026-06-12 | The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an in… |
CVE-2026-40996 | Medium | 4.8 | 2026-06-11 | Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Secu… |
CVE-2025-10237 | Medium | 6.7 | 2026-06-10 | During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller firmware that could allow a privileged lo… |
CVE-2026-11481 | Low | 2.5 | 2026-06-08 | A vulnerability was determined in yoanbernabeu grepai up to 0.35.0. The affected element is the function PostgresStore.LookupByContentHash of the file indexer/… |
CVE-2026-11479 | Medium | 4.2 | 2026-06-08 | A vulnerability has been found in yoanbernabeu grepai 0.35.0. This issue affects some unknown processing of the file indexer/chunker.go of the component Qdrant… |
CVE-2026-46395 | | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contain… |
CVE-2026-11330 | Low | 3.6 | 2026-06-05 | A weakness has been identified in thedotmack claude-mem up to 11.0.1. The affected element is the function computeObservationContentHash of the file src/servic… |
CVE-2026-11329 | Low | 3.6 | 2026-06-05 | A vulnerability has been found in onnx onnx-mlir up to 0.5.0.0. Affected by this issue is the function generate_hash_key of the file src/Runtime/python/torch_o… |
CVE-2026-10814 | Medium | 4.5 | 2026-06-04 | A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kv_catalog… |
CVE-2026-10813 | Low | 3.6 | 2026-06-04 | A flaw has been found in LMCache up to 0.4.6. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cac… |
CVE-2026-10812 | Low | 3.6 | 2026-06-04 | A vulnerability was detected in zilliztech GPTCache up to 0.1.44. Affected by this issue is the function BufferedReader.peek of the file gptcache/processor/pre… |
CVE-2026-10804 | Low | 3.6 | 2026-06-04 | A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the compon… |
CVE-2026-10803 | Low | 3.6 | 2026-06-04 | A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component… |
CVE-2026-10801 | Low | 3.6 | 2026-06-04 | A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template._save_pil_image of the file swift/template/ba… |
CVE-2026-10800 | Low | 3.6 | 2026-06-04 | A weakness has been identified in PaddlePaddle FastDeploy up to 2.4.1. Affected by this issue is the function hash_features of the file fastdeploy/multimodal/h… |
CVE-2026-10783 | Low | 2.5 | 2026-06-04 | A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Perfor… |
CVE-2026-10766 | Low | 3.6 | 2026-06-03 | A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helper… |
CVE-2026-36609 | High | 7.3 | 2026-06-03 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source I… |
CVE-2026-45701 | | | 2026-06-01 | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.23 and 3.0.6, the password reset tokenand API key ge… |
CVE-2026-49323 | Medium | 4.3 | 2026-05-29 | Weak authentication between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year… |
CVE-2026-49322 | Medium | 4.3 | 2026-05-29 | Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with… |
CVE-2025-46371 | Low | 3.6 | 2026-05-22 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the ssh. A low privileged attacker w… |
CVE-2026-44053 | High | 7.4 | 2026-05-21 | Netatalk 1.5.0 through 4.2.2 uses a broken cryptographic algorithm in the DHCAST128 UAM, which allows a remote attacker to obtain authentication credentials or… |
CVE-2026-8803 | Low | 3.7 | 2026-05-18 | A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the compone… |
CVE-2026-44699 | | | 2026-05-15 | LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS25… |
CVE-2026-8072 | | | 2026-05-12 | Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the… |
CVE-2026-6411 | High | 7.3 | 2026-05-07 | This vulnerability, in the MAXHUB Pivot client application versions
prior to v1.36.2, may allow an attacker to obtain encrypted tenant email
addresses and re… |
CVE-2026-44405 | Low | 3.4 | 2026-05-06 | In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm. |
CVE-2026-7845 | Low | 2.6 | 2026-05-05 | A flaw has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. This issue affects the function PIL.Image.tobytes of the file libs/chatchat-server/ch… |
CVE-2026-7103 | Low | 3.7 | 2026-04-27 | A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file update_user.php of the component MD5 Hash Handler… |
CVE-2026-5926 | Medium | 6.5 | 2026-04-23 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 thr… |
CVE-2026-32959 | Medium | 5.9 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a broken or risky cryptographic algorithm. Information in the traffi… |
CVE-2026-5588 | High | 7.5 | 2026-04-15 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy C… |
CVE-2025-14813 | High | 7.5 | 2026-04-15 | : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).
This vulnerability… |
CVE-2026-29129 | High | 7.5 | 2026-04-09 | Configured cipher preference order not preserved vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51… |
CVE-2025-14859 | | | 2026-04-07 | The Semtech LR11xx LoRa transceivers implement secure boot functionality using digital signatures to authenticate firmware. However, the implementation uses a… |
CVE-2026-5682 | Low | 3.7 | 2026-04-06 | A vulnerability has been found in Meesho Online Shopping App up to 27.3 on Android. Affected is an unknown function of the file /api/endpoint of the component… |
CVE-2026-34950 | Critical | 9.1 | 2026-04-06 | fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that… |
CVE-2025-13916 | Medium | 5.9 | 2026-04-01 | IBM Aspera Shares 1.9.9 through 1.11.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information |
CVE-2026-25834 | Medium | 6.5 | 2026-04-01 | Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade. |
CVE-2019-25651 | High | 8.3 | 2026-03-27 | Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW… |
CVE-2026-33512 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication… |
CVE-2026-28490 | Medium | 6.5 | 2026-03-16 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified… |
CVE-2026-20996 | Medium | 5.3 | 2026-03-16 | Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15 allows remote attackers to configure a downgraded scheme for authen… |
CVE-2026-28252 | Critical | 9.8 | 2026-03-12 | A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authent… |
CVE-2025-41711 | Medium | 5.3 | 2026-03-10 | An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access. |
CVE-2026-28479 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox configurations, which is deprecated and vul… |
CVE-2025-13476 | Critical | 9.8 | 2026-03-05 | Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension dive… |
CVE-2026-3598 | High | 7.5 | 2026-03-05 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro on Windows, MacOS, Linux (Config… |
CVE-2026-30791 | High | 7.5 | 2026-03-05 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebCl… |
CVE-2026-23601 | Medium | 5.4 | 2026-03-04 | A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can generate shared-key authenticated transmi… |
CVE-2025-14480 | Medium | 5.1 | 2026-03-03 | IBM Aspera faspio Gateway 1.3.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information |
CVE-2025-14456 | Medium | 5.9 | 2026-03-03 | IBM MQ Appliance 9.4 CD through 9.4.4.0 to 9.4.4.1 |
CVE-2025-63912 | High | 7.5 | 2026-03-03 | Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to use a weak cryptography algorithm for data encryption, allowing attackers to tr… |
CVE-2026-1627 | Medium | 6.5 | 2026-02-27 | An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of the SSH session, all… |
CVE-2026-1626 | Medium | 6.5 | 2026-02-27 | An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH com… |
CVE-2026-21718 | Critical | 10.0 | 2026-02-27 | An authentication bypass vulnerability exists in Copeland XWEB Pro
version 1.12.1 and prior, enabling any attackers to bypass the
authentication requirement… |
CVE-2026-27804 | Critical | 9.1 | 2026-02-26 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthent… |
CVE-2026-27519 | High | 7.5 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded in client-side JavaScript. Because the k… |
CVE-2024-43178 | Medium | 5.9 | 2026-02-17 | IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
CVE-2026-2618 | Low | 3.7 | 2026-02-17 | A vulnerability was determined in Beetel 777VR1 up to 01.00.09. This impacts an unknown function of the component SSH Service. This manipulation causes risky c… |
CVE-2026-26219 | Critical | 9.1 | 2026-02-12 | newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational… |
CVE-2025-66598 | High | 7.5 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
This product supports
old SSL/TLS versions, potentially allowing an… |
CVE-2025-66597 | High | 7.5 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
This product supports
weak cryptographic algorithms, potentially all… |
CVE-2025-69929 | Critical | 9.8 | 2026-01-29 | An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using th… |
CVE-2025-62514 | High | 8.3 | 2026-01-29 | Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of… |
CVE-2026-24785 | Critical | 9.1 | 2026-01-28 | Clatter is a no_std compatible, pure Rust implementation of the Noise protocol framework with post-quantum support. Versiosn prior to2.2.0 have a protocol comp… |
CVE-2026-22585 | Critical | 9.8 | 2026-01-24 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subsc… |
CVE-2025-52026 | High | 7.5 | 2026-01-23 | An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-05-28. This unauthe… |
CVE-2025-58743 | High | 7.5 | 2026-01-20 | Use of a Broken or Risky Cryptographic Algorithm (DES) vulnerability
in the Password class in C2SConnections.dll in Milner ImageDirector Capture on Windows a… |
CVE-2026-21907 | Medium | 5.9 | 2026-01-15 | A Use of a Broken or Risky Cryptographic Algorithm vulnerability in the TLS/SSL server of Juniper Networks Junos Space allows the use of static key ciphers (ss… |
CVE-2025-68931 | High | 7.5 | 2026-01-13 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, AES/CBC/PKCS5Padding lacks authentication, making it vulner… |
CVE-2025-68702 | High | 7.5 | 2026-01-13 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses padLeft(32, '0') when it should use padLeft(64… |