openssl_encrypt before 1.4.9 Weak Pepper Key Derivation
CVE-2026-81689
openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of th
2026-08-28 归档
今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256
CVE-2026-81688
openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metada
openssl_encrypt before 1.4.9 Denial of Service via KDF
CVE-2026-81687
openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specifi
openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass
CVE-2026-81686
openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set m
openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata
CVE-2026-81685
openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to
openssl_encrypt before 1.4.9 Information Disclosure via Command Line
CVE-2026-81684
In openssl_encrypt (pip package openssl-encrypt) versions /cmdline for the lifetime of the subprocess. Fixed in 1.4.9.
openssl_encrypt before 1.4.9 Plaintext Private Key Storage
CVE-2026-81683
openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext w
openssl_encrypt before 1.4.9 Insecure File Permissions
CVE-2026-81682
openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes
openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage
CVE-2026-81681
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB
openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal
CVE-2026-81680
openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, al
OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API
CVE-2026-81679
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST AP
darknet through 6.0 Out-of-Bounds Read and Write via Unchecked Layer Index in .cfg Parser
CVE-2026-81334
darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's
Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint
CVE-2026-81101
The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute i
Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport
CVE-2026-81098
The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mc
rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape
CVE-2026-81097
The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with repl
ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape
CVE-2026-81096
ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authenticat
mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL
CVE-2026-81091
The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in librar
CVE-2026-80213
CVE-2026-80213
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length
CVE-2026-80212
CVE-2026-80212
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource:
Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input
CVE-2026-81827
Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That doe