Jahlives OpenSSL Encrypt
66 CVEs affecting Jahlives OpenSSL Encrypt. Latest disclosed: 2026-08-27. Critical: 18, High: 24.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81707 | Critical | 9.8 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge th… |
CVE-2026-81702 | Critical | 9.8 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public k… |
CVE-2026-81701 | Critical | 9.8 | 2026-08-27 | openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unkn… |
CVE-2026-81700 | Critical | 9.8 | 2026-08-27 | openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by onl… |
CVE-2026-74901 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenti… |
CVE-2026-74900 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, genera… |
CVE-2026-74899 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() bu… |
CVE-2026-74896 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute… |
CVE-2026-74895 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute mali… |
CVE-2026-74894 | Critical | 9.8 | 2026-08-17 | openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string wi… |
CVE-2026-74891 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access… |
CVE-2026-74889 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determini… |
CVE-2026-74886 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST… |
CVE-2026-74880 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from… |
CVE-2026-74878 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server res… |
CVE-2026-74876 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying sig… |
CVE-2026-74875 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be acce… |
CVE-2026-74872 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to l… |
CVE-2026-74893 | High | 8.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source c… |
CVE-2026-74883 | High | 8.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pa… |