Medium
CVE-2026-74879
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 60
Reset filters
Unrated
CVE-2026-74883
openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can imp
Critical
CVE-2026-74878
openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart
Medium
CVE-2026-74880
openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage
Medium
CVE-2026-74877
openssl-encrypt has no owner verification on key revocation — any client can revoke any key
Critical
CVE-2026-74882
openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private netw
Medium
CVE-2026-74871
openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no
Unrated
CVE-2026-74870
openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardw
Medium
CVE-2026-74874
openssl-encrypt has non-cryptographic PRNG used for steganography pixel selection
Medium
CVE-2026-74875
openssl-encrypt silently skips schema validation when jsonschema library is not installed
Medium
CVE-2026-74873
openssl-encrypt has visible password in process list via --password CLI argument
Medium
CVE-2026-74872
openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.