Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
9.3 CRITICAL
CVE-2026-81714 — openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass

openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (for…

Remote | Cryptography
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
9.8 CRITICAL
CVE-2026-81707 — openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email

openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displaye…

Remote | Information Disclosure
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
9.3 CRITICAL
CVE-2026-81706 — openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing

openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corr…

Remote | Cryptography
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.7 HIGH
CVE-2026-81705 — openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option s…

Remote | Information Disclosure
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.7 HIGH
CVE-2026-81704 — openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perfo…

Remote | Cryptography
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.7 HIGH
CVE-2026-81703 — openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key

openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decr…

Remote | Cryptography
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
9.8 CRITICAL
CVE-2026-81702 — openssl_encrypt before 1.4.9 Key Substitution via Identity Load

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can re…

Remote | Cryptography
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
9.8 CRITICAL
CVE-2026-81701 — openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin

openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature v…

Remote | Misconfiguration
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
9.8 CRITICAL
CVE-2026-81700 — openssl_encrypt before 1.4.9 GPG Signature Verification Bypass

openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspe…

Remote | Cryptography
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.7 HIGH
CVE-2026-81699 — openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost

openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentica…

Remote | Denial of Service
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
9.3 CRITICAL
CVE-2026-81698 — openssl_encrypt before 1.4.9 Shell Injection via info command

openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can …

Remote | Injection
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.7 HIGH
CVE-2026-81697 — openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE (originally the absolute per-user pat…

Remote | Misconfiguration
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
9.3 CRITICAL
CVE-2026-81696 — openssl_encrypt before 1.4.9 Terminal Injection via info Command

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to rep…

Remote | Information Disclosure
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
9.3 CRITICAL
CVE-2026-81695 — openssl_encrypt before 1.4.9 Terminal Injection via key_id

openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id conta…

Remote | Information Disclosure
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
9.3 CRITICAL
CVE-2026-81694 — verify-usb before 1.4.9 Output Injection via Unsanitized Filenames

openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command…

Remote | Information Disclosure
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.7 HIGH
CVE-2026-81693 — openssl_encrypt before 1.4.9 Denial of Service via QR total field

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger u…

Remote | Denial of Service
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.7 HIGH
CVE-2026-81692 — openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO

openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(siz…

Remote | Denial of Service
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.7 HIGH
CVE-2026-81691 — openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs

openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path…

Remote | Misconfiguration
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.7 HIGH
CVE-2026-81690 — verify-usb before 1.4.9 Symlink Directory Traversal Code Execution

openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not desc…

Remote | Path Traversal
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
8.7 HIGH
CVE-2026-81689 — openssl_encrypt before 1.4.9 Weak Pepper Key Derivation

openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with …

Remote | Cryptography
Aug 27, 2026 Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Showing 20 of 12301 Results