Jahlives OpenSSL Encrypt
25 CVEs affecting Jahlives OpenSSL Encrypt. Latest disclosed: 2026-08-17. Critical: 13, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-74901 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenti… |
CVE-2026-74900 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, genera… |
CVE-2026-74899 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() bu… |
CVE-2026-74896 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute… |
CVE-2026-74895 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute mali… |
CVE-2026-74894 | Critical | 9.8 | 2026-08-17 | openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string wi… |
CVE-2026-74891 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access… |
CVE-2026-74889 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determini… |
CVE-2026-74886 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST… |
CVE-2026-74880 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from… |
CVE-2026-74878 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server res… |
CVE-2026-74876 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying sig… |
CVE-2026-74875 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be acce… |
CVE-2026-74893 | High | 8.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source c… |
CVE-2026-74883 | High | 8.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pa… |
CVE-2026-74877 | High | 8.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revo… |
CVE-2026-74892 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing… |
CVE-2026-74888 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose s… |
CVE-2026-74884 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before… |
CVE-2026-74882 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig t… |