110,684 indexed
CVECVE vulnerabilities
110,684 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 12,401–12,450 of 110,684 · page 249 of 2214
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81719 | CVE-2026-81719 CVSS 7.8jahlives | openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/u… |
| CVE-2026-81718 | CVE-2026-81718 CVSS 7.5 | openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 it… |
| CVE-2026-81717 | CVE-2026-81717 CVSS 3.5jahlives | openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable d… |
| CVE-2026-81716 | CVE-2026-81716 CVSS 5.2jahlives | openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a… |
| CVE-2026-81715 | CVE-2026-81715 CVSS 3.3jahlives | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-to… |
| CVE-2026-81714 | CVE-2026-81714 CVSS 7.0jahlives | openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust ancho… |
| CVE-2026-81707 | CVE-2026-81707 CVSS 9.8 | openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge th… |
| CVE-2026-81706 | CVE-2026-81706 CVSS 6.8jahlives | openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed … |
| CVE-2026-81705 | CVE-2026-81705 CVSS 7.5jahlives | openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. … |
| CVE-2026-81704 | CVE-2026-81704 CVSS 7.5jahlives | openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 … |
| CVE-2026-81703 | CVE-2026-81703 CVSS 5.5jahlives | openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with… |
| CVE-2026-81702 | CVE-2026-81702 CVSS 9.8jahlives | openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public k… |
| CVE-2026-81701 | CVE-2026-81701 CVSS 9.8jahlives | openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unkn… |
| CVE-2026-81700 | CVE-2026-81700 CVSS 9.8jahlives | openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by onl… |
| CVE-2026-8170 | CVE-2026-8170 | The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of… |
| CVE-2026-81699 | CVE-2026-81699 CVSS 7.5jahlives | openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory … |
| CVE-2026-81698 | CVE-2026-81698 CVSS 7.5jahlives | openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadat… |
| CVE-2026-81697 | CVE-2026-81697 CVSS 5.5 | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FI… |
| CVE-2026-81696 | CVE-2026-81696 CVSS 3.3jahlives | openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious … |
| CVE-2026-81695 | CVE-2026-81695 CVSS 3.3jahlives | openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft enc… |
| CVE-2026-81694 | CVE-2026-81694 CVSS 3.3jahlives | openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before… |
| CVE-2026-81693 | CVE-2026-81693 CVSS 7.5jahlives | openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with e… |
| CVE-2026-81692 | CVE-2026-81692 CVSS 7.5 | openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to s… |
| CVE-2026-81691 | CVE-2026-81691 CVSS 7.5jahlives | openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigu… |
| CVE-2026-81690 | CVE-2026-81690 CVSS 7.3jahlives | openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with… |
| CVE-2026-8169 | CVE-2026-8169 | ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insu… |
| CVE-2026-81689 | CVE-2026-81689 CVSS 7.5jahlives | openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys acr… |
| CVE-2026-81688 | CVE-2026-81688 CVSS 7.5jahlives | openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash withou… |
| CVE-2026-81687 | CVE-2026-81687 CVSS 5.5 | openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craf… |
| CVE-2026-81686 | CVE-2026-81686 CVSS 6.2jahlives | openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authori… |
| CVE-2026-81685 | CVE-2026-81685 CVSS 3.3jahlives | openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line sepa… |
| CVE-2026-81684 | CVE-2026-81684 CVSS 6.2jahlives | In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command l… |
| CVE-2026-81683 | CVE-2026-81683 CVSS 8.4jahlives | openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPre… |
| CVE-2026-81682 | CVE-2026-81682 CVSS 6.2 | openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable… |
| CVE-2026-81681 | CVE-2026-81681 CVSS 4.6jahlives | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption … |
| CVE-2026-81680 | CVE-2026-81680 CVSS 4.0jahlives | openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slo… |
| CVE-2026-8168 | CVE-2026-8168 | Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application cr… |
| CVE-2026-81679 | CVE-2026-81679 CVSS 7.7 | OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administ… |
| CVE-2026-81678 | CVE-2026-81678 CVSS 7.5 | AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64,… |
| CVE-2026-81677 | CVE-2026-81677 | The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL sy… |
| CVE-2026-81676 | CVE-2026-81676 | A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without pro… |
| CVE-2026-81675 | CVE-2026-81675 | The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in … |
| CVE-2026-81674 | CVE-2026-81674 | The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a Mar… |
| CVE-2026-81673 | CVE-2026-81673 | The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sani… |
| CVE-2026-81672 | CVE-2026-81672 | SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanit… |
| CVE-2026-8167 | CVE-2026-8167 CVSS 6.1 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solutions News Theme V8 allows Reflected XS… |
| CVE-2026-81669 | CVE-2026-81669 CVSS 7.2ibm | IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create csr wildcard CLI command. An authenticated privileged CLI us… |
| CVE-2026-81668 | CVE-2026-81668 CVSS 5.4 | A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated… |
| CVE-2026-81666 | CVE-2026-81666 CVSS 6.5 | An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-… |
| CVE-2026-81665 | CVE-2026-81665 CVSS 7.5 | A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffe… |