Latest high and critical flaws
- CVE-2026-81721 openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memoHigh 8.7 · Aug 27, 2026
- CVE-2026-81719 openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unCritical 9.3 · Aug 27, 2026
- CVE-2026-81718 openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 iteHigh 8.7 · Aug 27, 2026
- CVE-2026-81717 openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drCritical 9.3 · Aug 27, 2026
- CVE-2026-81716 openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a High 8.7 · Aug 27, 2026
- CVE-2026-81715 openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-tokHigh 8.7 · Aug 27, 2026
- CVE-2026-81714 openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchorCritical 9.3 · Aug 27, 2026
- CVE-2026-81707 openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge theCritical 9.3 · Aug 27, 2026
- CVE-2026-81706 openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed cCritical 9.3 · Aug 27, 2026
- CVE-2026-81705 openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g.High 8.7 · Aug 27, 2026
- CVE-2026-81704 openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 iHigh 8.7 · Aug 27, 2026
- CVE-2026-81703 openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata.High 8.7 · Aug 27, 2026
- CVE-2026-81702 openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keCritical 9.3 · Aug 27, 2026
- CVE-2026-81701 openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknoCritical 9.3 · Aug 27, 2026
- CVE-2026-81700 openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by onlyCritical 9.3 · Aug 27, 2026
- CVE-2026-81699 openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory aHigh 8.7 · Aug 27, 2026
- CVE-2026-81698 openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadataCritical 9.3 · Aug 27, 2026
- CVE-2026-81697 openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILHigh 8.7 · Aug 27, 2026
- CVE-2026-81696 openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command.Critical 9.3 · Aug 27, 2026
- CVE-2026-81695 openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection.Critical 9.3 · Aug 27, 2026
- CVE-2026-81694 openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before Critical 9.3 · Aug 27, 2026
- CVE-2026-81693 openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges.High 8.7 · Aug 27, 2026
- CVE-2026-81692 openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to siHigh 8.7 · Aug 27, 2026
- CVE-2026-81691 openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigurHigh 8.7 · Aug 27, 2026
- CVE-2026-81690 openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan.High 8.7 · Aug 27, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.