CVE-2026-81721 | High | 7.5 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded mem… |
CVE-2026-81720 | Medium | 6.2 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory cond… |
CVE-2026-81719 | High | 7.8 | 2026-08-27 | openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/u… |
CVE-2026-81718 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 it… |
CVE-2026-81717 | Low | 3.5 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable d… |
CVE-2026-81716 | Medium | 5.2 | 2026-08-27 | openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a… |
CVE-2026-81715 | Low | 3.3 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-to… |
CVE-2026-81714 | High | 7.0 | 2026-08-27 | openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust ancho… |
CVE-2026-81707 | Critical | 9.8 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge th… |
CVE-2026-81706 | Medium | 6.8 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed… |
CVE-2026-81705 | High | 7.5 | 2026-08-27 | openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g… |
CVE-2026-81704 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256… |
CVE-2026-81703 | Medium | 5.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with… |
CVE-2026-81702 | Critical | 9.8 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public k… |
CVE-2026-81701 | Critical | 9.8 | 2026-08-27 | openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unkn… |
CVE-2026-81700 | Critical | 9.8 | 2026-08-27 | openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by onl… |
CVE-2026-81699 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory… |
CVE-2026-81698 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadat… |
CVE-2026-81697 | Medium | 5.5 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FI… |
CVE-2026-81696 | Low | 3.3 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious… |
CVE-2026-81695 | Low | 3.3 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft enc… |
CVE-2026-81694 | Low | 3.3 | 2026-08-27 | openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before… |
CVE-2026-81693 | High | 7.5 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with e… |
CVE-2026-81692 | High | 7.5 | 2026-08-27 | openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to s… |
CVE-2026-81691 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigu… |
CVE-2026-81690 | High | 7.3 | 2026-08-27 | openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with… |
CVE-2026-81689 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys acr… |
CVE-2026-81688 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash withou… |
CVE-2026-81687 | Medium | 5.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craf… |
CVE-2026-81686 | Medium | 6.2 | 2026-08-27 | openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authori… |
CVE-2026-81685 | Low | 3.3 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line sepa… |
CVE-2026-81684 | Medium | 6.2 | 2026-08-27 | In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command l… |
CVE-2026-81683 | High | 8.4 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPre… |
CVE-2026-81682 | Medium | 6.2 | 2026-08-27 | openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable… |
CVE-2026-81681 | Medium | 4.6 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption… |
CVE-2026-81680 | Medium | 4.0 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slo… |
CVE-2026-74901 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenti… |
CVE-2026-74900 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, genera… |
CVE-2026-74899 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() bu… |
CVE-2026-74896 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute… |
CVE-2026-74895 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute mali… |
CVE-2026-74894 | Critical | 9.8 | 2026-08-17 | openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string wi… |
CVE-2026-74893 | High | 8.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source c… |
CVE-2026-74892 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing… |
CVE-2026-74891 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access… |
CVE-2026-74890 | Medium | 5.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when… |
CVE-2026-74889 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determini… |
CVE-2026-74888 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose s… |
CVE-2026-74887 | Low | 3.7 | 2026-08-17 | openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct… |
CVE-2026-74886 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST… |
CVE-2026-74885 | Low | 3.6 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored mo… |
CVE-2026-74884 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before… |
CVE-2026-74883 | High | 8.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pa… |
CVE-2026-74882 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig t… |
CVE-2026-74881 | Medium | 6.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious w… |
CVE-2026-74880 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from… |
CVE-2026-74879 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to un… |
CVE-2026-74878 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server res… |
CVE-2026-74877 | High | 8.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revo… |
CVE-2026-74876 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying sig… |
CVE-2026-74875 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be acce… |
CVE-2026-74874 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence fun… |
CVE-2026-74873 | Medium | 5.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can… |
CVE-2026-74872 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to l… |
CVE-2026-74871 | Medium | 6.2 | 2026-08-17 | openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation… |
CVE-2026-74870 | Low | 3.3 | 2026-08-17 | openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unc… |