Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

openssl-encrypt

60 known vulnerabilities (29 critical, 26 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
1.4.9 (Aug 13, 2026): no advisory affects it
Newest unaffected release
1.4.9 (Aug 13, 2026), the latest release
Advisories
60 · 29 critical, 26 high, 5 medium
Weekly downloads
114
Dependents
0
Releases
54 since 0.2.2 (Apr 8, 2025)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 60 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 60

  • openssl_encrypt before 1.4.9 Denial of Service via KDF

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81720Medium 6.9

    openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81719Critical 9.3

    openssl_encrypt before 1.4.9 Remote Code Execution via Plugin

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81717Critical 9.3

    openssl_encrypt before 1.4.9 Integrity Bypass via Added Files

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.9 Plugin Sandbox Path Traversal

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.9 Credential Exposure via Debug Output

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81714Critical 9.3

    openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81706Critical 9.3

    openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81702Critical 9.3

    openssl_encrypt before 1.4.9 Key Substitution via Identity Load

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81701Critical 9.3

    openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81700Critical 9.3

    openssl_encrypt before 1.4.9 GPG Signature Verification Bypass

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

Show all 60 advisoriesShow fewer advisories
  • CVE-2026-81698Critical 9.3

    openssl_encrypt before 1.4.9 Shell Injection via info command

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81696Critical 9.3

    openssl_encrypt before 1.4.9 Terminal Injection via info Command

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81695Critical 9.3

    openssl_encrypt before 1.4.9 Terminal Injection via key_id

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81694Critical 9.3

    openssl-encrypt before 1.4.9 Output Injection via Unsanitized Filenames in verify-usb Command

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.9 Denial of Service via QR total field

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • verify-usb before 1.4.9 Symlink Directory Traversal Code Execution

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.9 Weak Pepper Key Derivation

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81686Medium 6.9

    openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81685Critical 9.3

    openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81684Medium 6.9

    openssl_encrypt before 1.4.9 Information Disclosure via Command Line

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.9 Plaintext Private Key Storage

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81681Critical 9.3

    openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-81680Critical 9.3

    openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74901Critical 9.3

    openssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74900Critical 9.3

    openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74899Critical 9.3

    openssl_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74896Critical 9.3

    openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74895Critical 9.3

    openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74894Critical 9.3

    openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.0 Hardcoded Secret Key

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.0 Hardcoded Database Credentials

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74890Critical 9.3

    openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74889Critical 9.3

    openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key Derivation

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74887Medium 6.3

    openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74886Critical 9.3

    openssl_encrypt before 1.4.0 Plugin Import Guard Bypass

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74885Critical 9.3

    openssl_encrypt before 1.4.0 Logging Bug and Race Condition

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.0 Path Traversal via plugin_id

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and io

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.0 Insecure Default Configuration

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74880Critical 9.3

    openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74878Critical 9.3

    openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74876Critical 9.3

    openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74875Critical 9.3

    openssl_encrypt before 1.4.0 Schema Validation Bypass

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.0 Password Exposure via CLI Argument

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74872Critical 9.3

    openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • CVE-2026-74871Medium 6.9

    openssl_encrypt before 1.4.6 KDF Bypass via Sequential-XOR

    Affected: fixed in 1.4.6.

    Fixed in 1.4.6 (released Jun 29, 2026, 49 days before disclosure).

    The latest release, 1.4.9, is not affected.

  • openssl_encrypt before 1.4.8 Hardware Pepper Information Disclosure

    Affected: fixed in 1.4.7.

    Fixed in 1.4.7 (released Jun 29, 2026, 49 days before disclosure).

    The latest release, 1.4.9, is not affected.