openssl-encrypt vulnerabilities
CVEs whose affected-version data names the openssl-encrypt package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
53 CVEsRSS
CVE-2026-74894Noneopenssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty …
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all ke…
CVE-2026-74893Noneopenssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers w…
openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access …
CVE-2026-74891Noneopenssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the s…
openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensiti…
CVE-2026-74890Noneopenssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation …
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execu…
CVE-2026-74889Noneopenssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy ex…
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to …
CVE-2026-74888Noneopenssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, …
openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this…
CVE-2026-74886Noneopenssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of…
openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through st…
CVE-2026-74885Noneopenssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always sh…
openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists betwe…
CVE-2026-74884Noneopenssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is…
openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicio…
CVE-2026-74883Noneopenssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file …
openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and…
CVE-2026-74892Noneopenssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is use…
openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to …
CVE-2026-74887Medium· 5.9openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/mod…
openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is …
CVE-2026-74882Critical· 9.1openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in …
openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate hea…
CVE-2026-74899Noneopenssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects i…
openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro_…
CVE-2026-74877Mediumopenssl-encrypt has no owner verification on key revocation — any client can revoke any key
openssl-encrypt has no owner verification on key revocation — any client can revoke any key
CVE-2026-74876Mediumopenssl-encrypt's unverified key bundle from_dict() + to_identity() path allows encryption to attacker keys
openssl-encrypt's unverified key bundle from_dict() + to_identity() path allows encryption to attacker keys
CVE-2026-74880Mediumopenssl-encrypt accepts refresh tokens as URL query parameters causing token leakage
openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage
CVE-2026-74879Mediumopenssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers
openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers
CVE-2026-74874Mediumopenssl-encrypt has non-cryptographic PRNG used for steganography pixel selection
openssl-encrypt has non-cryptographic PRNG used for steganography pixel selection
CVE-2026-74872Mediumopenssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification
openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification
CVE-2026-74878Criticalopenssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart
openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart
CVE-2026-74873Mediumopenssl-encrypt has visible password in process list via --password CLI argument
openssl-encrypt has visible password in process list via --password CLI argument
CVE-2026-74875Mediumopenssl-encrypt silently skips schema validation when jsonschema library is not installed
openssl-encrypt silently skips schema validation when jsonschema library is not installed