# openssl-encrypt (PyPI) vulnerabilities 60 known vulnerabilities (29 critical, 26 high, 5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.4.9 (Aug 13, 2026): no advisory affects it - Newest unaffected release: 1.4.9 (Aug 13, 2026), the latest release - Weekly downloads: 114 - Dependents: 0 - Releases: 54 since 0.2.2 (Apr 8, 2025) - Registry: https://pypi.org/project/openssl-encrypt/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-81721: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81720: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81719: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81717: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81716: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81715: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81714: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81706: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81705: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81704: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81703: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81702: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81701: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81700: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81699: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81698: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81696: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81695: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81694: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81693: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81691: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81690: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81689: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81688: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81686: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81685: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81684: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81683: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81681: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-81680: 0.2.2 to 1.4.8 (1.4.9 is outside it) - CVE-2026-74901: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74900: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74899: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74896: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74895: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74894: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74893: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74892: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74891: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74890: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74889: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74888: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74887: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74886: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74885: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74884: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74883: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74882: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74881: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74880: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74879: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74878: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74877: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74876: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74875: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74874: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74873: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74872: 0.2.2 to 1.4.0b8 (1.4.0 is outside it) - CVE-2026-74871: 0.2.2 to 1.4.5 (1.4.6 is outside it) - CVE-2026-74870: 0.2.2 to 1.4.6 (1.4.7 is outside it) ## Advisories (60) ### [CVE-2026-81721](https://cve.now/CVE-2026-81721): openssl\_encrypt before 1.4.9 Denial of Service via KDF - Severity: High 8.7 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81720](https://cve.now/CVE-2026-81720): openssl\_encrypt before 1.4.9 Denial of Service via Unbounded Argon2 - Severity: Medium 6.9 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81719](https://cve.now/CVE-2026-81719): openssl\_encrypt before 1.4.9 Remote Code Execution via Plugin - Severity: Critical 9.3 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81717](https://cve.now/CVE-2026-81717): openssl\_encrypt before 1.4.9 Integrity Bypass via Added Files - Severity: Critical 9.3 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81716](https://cve.now/CVE-2026-81716): openssl\_encrypt before 1.4.9 Plugin Sandbox Path Traversal - Severity: High 8.7 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81715](https://cve.now/CVE-2026-81715): openssl\_encrypt before 1.4.9 Credential Exposure via Debug Output - Severity: High 8.7 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81714](https://cve.now/CVE-2026-81714): openssl\_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass - Severity: Critical 9.3 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81706](https://cve.now/CVE-2026-81706): openssl\_encrypt before 1.4.9 Key Substitution via Identity Shadowing - Severity: Critical 9.3 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81705](https://cve.now/CVE-2026-81705): openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug - Severity: High 8.7 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81704](https://cve.now/CVE-2026-81704): openssl\_encrypt before 1.4.9 Weak Key Derivation via D-Bus - Severity: High 8.7 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81703](https://cve.now/CVE-2026-81703): openssl\_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key - Severity: High 8.7 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81702](https://cve.now/CVE-2026-81702): openssl\_encrypt before 1.4.9 Key Substitution via Identity Load - Severity: Critical 9.3 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81701](https://cve.now/CVE-2026-81701): openssl\_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin - Severity: Critical 9.3 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81700](https://cve.now/CVE-2026-81700): openssl\_encrypt before 1.4.9 GPG Signature Verification Bypass - Severity: Critical 9.3 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81699](https://cve.now/CVE-2026-81699): openssl\_encrypt before 1.4.9 Denial of Service via unbounded KDF cost - Severity: High 8.7 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81698](https://cve.now/CVE-2026-81698): openssl\_encrypt before 1.4.9 Shell Injection via info command - Severity: Critical 9.3 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81696](https://cve.now/CVE-2026-81696): openssl\_encrypt before 1.4.9 Terminal Injection via info Command - Severity: Critical 9.3 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81695](https://cve.now/CVE-2026-81695): openssl\_encrypt before 1.4.9 Terminal Injection via key\_id - Severity: Critical 9.3 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81694](https://cve.now/CVE-2026-81694): openssl-encrypt before 1.4.9 Output Injection via Unsanitized Filenames in verify-usb Command - Severity: Critical 9.3 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81693](https://cve.now/CVE-2026-81693): openssl\_encrypt before 1.4.9 Denial of Service via QR total field - Severity: High 8.7 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81691](https://cve.now/CVE-2026-81691): openssl\_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs - Severity: High 8.7 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81690](https://cve.now/CVE-2026-81690): verify-usb before 1.4.9 Symlink Directory Traversal Code Execution - Severity: High 8.7 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81689](https://cve.now/CVE-2026-81689): openssl\_encrypt before 1.4.9 Weak Pepper Key Derivation - Severity: High 8.7 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81688](https://cve.now/CVE-2026-81688): openssl\_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256 - Severity: High 8.7 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81686](https://cve.now/CVE-2026-81686): openssl\_encrypt before 1.4.9 D-Bus Properties Authorization Bypass - Severity: Medium 6.9 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81685](https://cve.now/CVE-2026-81685): openssl\_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata - Severity: Critical 9.3 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81684](https://cve.now/CVE-2026-81684): openssl\_encrypt before 1.4.9 Information Disclosure via Command Line - Severity: Medium 6.9 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81683](https://cve.now/CVE-2026-81683): openssl\_encrypt before 1.4.9 Plaintext Private Key Storage - Severity: High 8.6 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81681](https://cve.now/CVE-2026-81681): openssl\_encrypt before 1.4.9 False Encryption via Cleartext Storage - Severity: Critical 9.3 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-81680](https://cve.now/CVE-2026-81680): openssl\_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal - Severity: Critical 9.3 - Published: Aug 27, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Aug 13, 2026, 14 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74901](https://cve.now/CVE-2026-74901): openssl\_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74900](https://cve.now/CVE-2026-74900): openssl\_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74899](https://cve.now/CVE-2026-74899): openssl\_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74896](https://cve.now/CVE-2026-74896): openssl\_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74895](https://cve.now/CVE-2026-74895): openssl\_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74894](https://cve.now/CVE-2026-74894): openssl\_encrypt before 1.4.0 Authentication Bypass via Bearer Token - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74893](https://cve.now/CVE-2026-74893): openssl\_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets - Severity: High 8.7 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74892](https://cve.now/CVE-2026-74892): openssl\_encrypt before 1.4.0 Hardcoded Secret Key - Severity: High 8.7 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74891](https://cve.now/CVE-2026-74891): openssl\_encrypt before 1.4.0 Hardcoded Database Credentials - Severity: High 8.7 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74890](https://cve.now/CVE-2026-74890): openssl\_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74889](https://cve.now/CVE-2026-74889): openssl\_encrypt before 1.4.0 Weak Key Derivation via HKDF - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74888](https://cve.now/CVE-2026-74888): openssl\_encrypt before 1.4.0 Non-Standard PBKDF2 Key Derivation - Severity: High 8.7 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74887](https://cve.now/CVE-2026-74887): openssl\_encrypt before 1.4.0 Insecure Random Import in PQC Module - Severity: Medium 6.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74886](https://cve.now/CVE-2026-74886): openssl\_encrypt before 1.4.0 Plugin Import Guard Bypass - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74885](https://cve.now/CVE-2026-74885): openssl\_encrypt before 1.4.0 Logging Bug and Race Condition - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74884](https://cve.now/CVE-2026-74884): openssl\_encrypt before 1.4.0 Path Traversal via plugin\_id - Severity: High 8.7 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74883](https://cve.now/CVE-2026-74883): openssl\_encrypt before 1.4.0 Sandbox Bypass via pathlib and io - Severity: High 8.7 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74882](https://cve.now/CVE-2026-74882): openssl\_encrypt before 1.4.0 Insecure Default Configuration - Severity: High 8.7 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74881](https://cve.now/CVE-2026-74881): openssl\_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins - Severity: High 7.1 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74880](https://cve.now/CVE-2026-74880): openssl\_encrypt before 1.4.0 Token Leakage via Query Parameters - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74879](https://cve.now/CVE-2026-74879): openssl\_encrypt before 1.4.0 Information Disclosure via /ready endpoint - Severity: High 8.7 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74878](https://cve.now/CVE-2026-74878): openssl\_encrypt before 1.4.0 TOTP Rate Limiter Bypass - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74877](https://cve.now/CVE-2026-74877): openssl\_encrypt before 1.4.0 Missing Ownership Verification via revoke\_key - Severity: High 8.7 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74876](https://cve.now/CVE-2026-74876): openssl\_encrypt before 1.4.0 Unverified Key Bundle Encryption - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74875](https://cve.now/CVE-2026-74875): openssl\_encrypt before 1.4.0 Schema Validation Bypass - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74874](https://cve.now/CVE-2026-74874): openssl\_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection - Severity: High 8.7 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74873](https://cve.now/CVE-2026-74873): openssl\_encrypt before 1.4.0 Password Exposure via CLI Argument - Severity: High 8.7 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74872](https://cve.now/CVE-2026-74872): openssl\_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool - Severity: Critical 9.3 - Published: Aug 17, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 3, 2026, 167 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74871](https://cve.now/CVE-2026-74871): openssl\_encrypt before 1.4.6 KDF Bypass via Sequential-XOR - Severity: Medium 6.9 - Published: Aug 17, 2026 - Affected: fixed in 1.4.6. - Fixed in 1.4.6 (released Jun 29, 2026, 49 days before disclosure). - The latest release, 1.4.9, is not affected. ### [CVE-2026-74870](https://cve.now/CVE-2026-74870): openssl\_encrypt before 1.4.8 Hardware Pepper Information Disclosure - Severity: High 8.7 - Published: Aug 17, 2026 - Affected: fixed in 1.4.7. - Fixed in 1.4.7 (released Jun 29, 2026, 49 days before disclosure). - The latest release, 1.4.9, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/openssl-encrypt Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.