{"kind": "product", "path": "vulns/pypi/openssl-encrypt", "name": "openssl-encrypt", "product": "openssl-encrypt", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-81721", "noindex": false, "published": "2026-08-27T14:51:15.109Z", "modified": "2026-10-01T15:21:39.545Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00581, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81721", "title": "openssl_encrypt before 1.4.9 Denial of Service via KDF", "description": "openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to exhaust system memory and crash the process without authentication.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-7894-5gw8-69hr", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-kdf-2", "https://nvd.nist.gov/vuln/detail/CVE-2026-81721"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81720", "noindex": false, "published": "2026-08-27T14:51:14.352Z", "modified": "2026-10-01T15:21:38.913Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00185, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81720", "title": "openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2", "description": "openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive memory_cost values that cause the host to crash when unlocking identities before authentication.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-783h-8q2f-f762", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-unbounded-argon2", "https://nvd.nist.gov/vuln/detail/CVE-2026-81720"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81719", "noindex": false, "published": "2026-08-27T14:51:13.632Z", "modified": "2026-10-01T15:21:38.281Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00436, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81719", "title": "openssl_encrypt before 1.4.9 Remote Code Execution via Plugin", "description": "openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The only default gate was an incomplete, bypassable AST denylist. If a user is induced to load an attacker's plugin, this results in arbitrary code execution with the privileges of the user running openssl_encrypt. Fixed in 1.4.9 by defaulting the signature policy to ENFORCE for non-built-in plugins.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-587j-4r3v-cm2c", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-remote-code-execution-via-plugin", "https://nvd.nist.gov/vuln/detail/CVE-2026-81719"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81717", "noindex": false, "published": "2026-08-27T14:51:12.140Z", "modified": "2026-10-01T15:21:36.966Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00118, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81717", "title": "openssl_encrypt before 1.4.9 Integrity Bypass via Added Files", "description": "openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical write access). USBDriveCreator._verify_integrity_file only validates files listed in the manifest, so files added to the drive — including a root-level autorun payload — are not detected and integrity verification still passes. Additionally, a globally constant, source-embedded KDF salt (_LEGACY_FIXED_SALT) is used to derive the drive encryption key for any drive lacking a per-drive salt file, defeating precomputation resistance and enabling an ", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-8jx3-27qf-3p97", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-integrity-bypass-via-added-files", "https://nvd.nist.gov/vuln/detail/CVE-2026-81717"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81716", "noindex": false, "published": "2026-08-27T14:51:11.331Z", "modified": "2026-10-01T15:21:36.350Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00261, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81716", "title": "openssl_encrypt before 1.4.9 Plugin Sandbox Path Traversal", "description": "openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READ_FILES permission could read or write another plugin's directory that merely shares a name prefix (e.g., .../plugins/foobar matching allowed .../plugins/foo), breaking per-plugin isolation within the same user. Fixed by matching each allowed directory exactly or with a trailing path separator.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-vr4h-5xqv-xxxf", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-plugin-sandbox-path-traversal", "https://nvd.nist.gov/vuln/detail/CVE-2026-81716"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81715", "noindex": false, "published": "2026-08-27T14:51:10.592Z", "modified": "2026-10-01T15:21:35.647Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00261, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81715", "title": "openssl_encrypt before 1.4.9 Credential Exposure via Debug Output", "description": "openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-jqqp-pf9j-889j", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-credential-exposure-via-debug-output", "https://nvd.nist.gov/vuln/detail/CVE-2026-81715"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81714", "noindex": false, "published": "2026-08-27T14:51:09.904Z", "modified": "2026-10-01T15:21:35.038Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00199, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81714", "title": "openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass", "description": "openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-xg52-638v-jc5m", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-plugin-signing-trust-anchor-enrollment-bypass", "https://nvd.nist.gov/vuln/detail/CVE-2026-81714"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81706", "noindex": false, "published": "2026-08-27T14:51:08.461Z", "modified": "2026-10-01T15:21:33.701Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00181, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81706", "title": "openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing", "description": "openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-8gmx-w9m8-vx7q", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-shadowing", "https://nvd.nist.gov/vuln/detail/CVE-2026-81706"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81705", "noindex": false, "published": "2026-08-27T14:51:07.685Z", "modified": "2026-10-01T15:21:33.058Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0044, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81705", "title": "openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug", "description": "openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log) can recover the password.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-jgvm-7jxv-cgcc", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-password-cleartext-leak-via-debug", "https://nvd.nist.gov/vuln/detail/CVE-2026-81705"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81704", "noindex": false, "published": "2026-08-27T14:51:06.960Z", "modified": "2026-10-01T15:21:32.379Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00272, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81704", "title": "openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus", "description": "openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-v9r6-grch-fxw7", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-weak-key-derivation-via-d-bus", "https://nvd.nist.gov/vuln/detail/CVE-2026-81704"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81703", "noindex": false, "published": "2026-08-27T14:51:06.238Z", "modified": "2026-10-01T15:21:31.727Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00223, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81703", "title": "openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key", "description": "openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false integrity verification.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-qqfq-g2cv-j7v3", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-authentication-bypass-via-unencrypted-pqc-key", "https://nvd.nist.gov/vuln/detail/CVE-2026-81703"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81702", "noindex": false, "published": "2026-08-27T14:51:05.523Z", "modified": "2026-10-01T15:21:31.062Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00187, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81702", "title": "openssl_encrypt before 1.4.9 Key Substitution via Identity Load", "description": "openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-q8p3-7h6h-ghfr", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-load", "https://nvd.nist.gov/vuln/detail/CVE-2026-81702"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81701", "noindex": false, "published": "2026-08-27T14:51:04.789Z", "modified": "2026-10-01T15:21:30.463Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00426, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81701", "title": "openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin", "description": "openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-wxx9-p55f-wm34", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-arbitrary-code-execution-via-unsigned-plugin", "https://nvd.nist.gov/vuln/detail/CVE-2026-81701"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81700", "noindex": false, "published": "2026-08-27T14:51:04.070Z", "modified": "2026-10-01T15:21:29.835Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00351, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81700", "title": "openssl_encrypt before 1.4.9 GPG Signature Verification Bypass", "description": "openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-x38r-8wf3-q9hq", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-gpg-signature-verification-bypass", "https://nvd.nist.gov/vuln/detail/CVE-2026-81700"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81699", "noindex": false, "published": "2026-08-27T14:51:03.419Z", "modified": "2026-10-01T15:21:29.151Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00505, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81699", "title": "openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost", "description": "openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-phmr-p567-q5g6", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-unbounded-kdf-cost", "https://nvd.nist.gov/vuln/detail/CVE-2026-81699"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81698", "noindex": false, "published": "2026-08-27T14:51:02.701Z", "modified": "2026-10-01T15:21:28.523Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00427, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81698", "title": "openssl_encrypt before 1.4.9 Shell Injection via info command", "description": "openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-gw2m-mj6q-59hc", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-shell-injection-via-info-command", "https://nvd.nist.gov/vuln/detail/CVE-2026-81698"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81696", "noindex": false, "published": "2026-08-27T14:50:59.793Z", "modified": "2026-10-01T15:21:27.302Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.0025, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81696", "title": "openssl_encrypt before 1.4.9 Terminal Injection via info Command", "description": "openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-539p-fxf4-7fv8", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-terminal-injection-via-info-command", "https://nvd.nist.gov/vuln/detail/CVE-2026-81696"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81695", "noindex": false, "published": "2026-08-27T14:50:59.059Z", "modified": "2026-10-01T15:21:26.653Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.0025, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81695", "title": "openssl_encrypt before 1.4.9 Terminal Injection via key_id", "description": "openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint terminal output and forge authenticity verification blocks.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-jwfm-99h7-2w5x", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-terminal-injection-via-key-id", "https://nvd.nist.gov/vuln/detail/CVE-2026-81695"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81694", "noindex": false, "published": "2026-08-27T14:50:58.318Z", "modified": "2026-10-01T15:21:26.011Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.0025, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81694", "title": "verify-usb before 1.4.9 Output Injection via Unsanitized Filenames", "description": "openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-c793-rj9w-r3wg", "https://www.vulncheck.com/advisories/verify-usb-before-1.4.9-output-injection-via-unsanitized-filenames", "https://nvd.nist.gov/vuln/detail/CVE-2026-81694"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-81693", "noindex": false, "published": "2026-08-27T14:50:57.596Z", "modified": "2026-10-01T15:21:25.346Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00493, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-81693", "title": "openssl_encrypt before 1.4.9 Denial of Service via QR total field", "description": "openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.", "references": ["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-r23m-gf2m-8www", "https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-qr-total-field", "https://nvd.nist.gov/vuln/detail/CVE-2026-81693"], "fixes": ["1.4.9"], "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}]}], "total": 60, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "openssl-encrypt", "path": "vulns/pypi/openssl-encrypt", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["1.4.8", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.2", "1.4.1rc2", "1.4.1", "1.4.0b8", "1.4.0b7", "1.4.0b6", "1.4.0b5"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-01T15:21:39.545Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}