Veille CVE

Mardi 1 septembre 2026

22 CVE

Critique 10 Élevée 6 Moyenne 3 Faible 3 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « OpenSSL » ✕
  1. CVE-2026-81696 3.3 Faible

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.

  2. CVE-2026-81695 3.3 Faible

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint terminal output and forge authenticity verification blocks.

  3. CVE-2026-81698 8.8 Élevée

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.

  4. CVE-2026-81700 9.8 Critique

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.

  5. CVE-2026-81701 9.8 Critique

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.

  6. CVE-2026-81703 5.5 Moyenne

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false integrity verification.

  7. CVE-2026-81705 7.5 Élevée

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log) can recover the password.

  8. CVE-2026-81706 6.8 Moyenne

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.

  9. CVE-2026-74901 9.8 Critique

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.

  10. CVE-2026-74883 8.8 Élevée

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls.

  11. CVE-2026-74884 7.5 Élevée

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.

  12. CVE-2026-74885 3.6 Faible

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another thread could re-import blocked modules in multi-threaded environments.

  13. CVE-2026-74886 9.8 Critique

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution.

  14. CVE-2026-74888 7.5 Élevée

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations.

  15. CVE-2026-74889 9.8 Critique

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.

  16. CVE-2026-74890 5.5 Moyenne

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data.

  17. CVE-2026-74891 9.8 Critique

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data.

  18. CVE-2026-74893 8.8 Élevée

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs.

  19. CVE-2026-74894 9.8 Critique

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.

  20. CVE-2026-74895 9.8 Critique

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules.

  21. CVE-2026-74896 9.8 Critique

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use __class__, __bases__, __subclasses__(), and __globals__ chains to access restricted functions and execute arbitrary system commands from plugin code.

  22. CVE-2026-74900 9.8 Critique

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain 16 bytes of the private key can compute the shared secret and decrypt all ciphertext, as the fallback triggers on any KEM failure without raising an error.