66
CVEs
30
Critical
31
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
30
HIGH
31
MEDIUM
5
LOW
0
Monthly CVE Trend
Affected Products (6)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-74872 | Arbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from its Whirlpool hash routine loading .so extension modules via a broad glob pattern without any integrity check. An attacker who can drop a file matching 'whirlpool*py313*.so' into a site-packages directory gets their code executed in-process the moment the hashing module is imported. Reported by VulnCheck; a vendor patch (1.4.0) exists, and there is no public exploit identified at time of analysis. | CRITICAL | 9.3 | 0.5% | 47 |
|
| CVE-2026-81707 | Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in the email field of an imported identity document, rewriting the terminal line that displays a key fingerprint. A remote, unauthenticated attacker who delivers a crafted identity bundle via normal contact-exchange or keyserver flows can make the tool render a fraudulent fingerprint, defeating the out-of-band verification that guards against key-substitution (MITM) attacks. No public exploit is identified at time of analysis and it is not on CISA KEV. | CRITICAL | 9.3 | 0.4% | 47 |
|
| CVE-2026-74895 | Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run without any isolation because the default process-isolation mode silently fails to enforce its sandbox restrictions. An attacker able to supply or influence a plugin gains unrestricted filesystem, network, subprocess, and full Python-module access equivalent to arbitrary code execution. Reported by VulnCheck with a vendor patch available; no public exploit code or CISA KEV listing is identified at time of analysis (CVSS 4.0 base 9.3). | CRITICAL | 9.3 | 0.4% | 47 |
|
| CVE-2026-74886 | Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime PluginImportGuard and the static AST analyzer enforce two different blocklists, so an attacker who slips past the AST's DANGEROUS_MODULES check can still import high-risk modules at runtime. By using string obfuscation or encoding to hide imports of sys, shutil, multiprocessing, importlib, or pickle, a supplied plugin escapes the sandbox and runs on the host. Reported by VulnCheck with a vendor patch available; no public exploit has been identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.3 | 0.4% | 47 |
|
| CVE-2026-74894 | Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated attackers fully control the key-management API because verify_api_token treats any non-empty Bearer string as valid. An attacker can upload attacker-controlled public keys, enumerate every stored key, and revoke keys belonging to arbitrary users, undermining the confidentiality and integrity guarantees the tool is meant to provide. The flaw is vendor-confirmed with a patch available and was reported by VulnCheck; no public exploit identified at time of analysis, though the trivial nature makes weaponization simple. | CRITICAL | 9.3 | 0.4% | 47 |
|
| CVE-2026-74878 | Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate limiter is held in per-process in-memory state (a class-level defaultdict) rather than shared storage. In multi-worker or multi-instance deployments each worker enforces its own independent counters, and all lockout state evaporates on restart, so an attacker can parallelize or restart-reset their way through TOTP guesses. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; a vendor patch exists in 1.4.0. | CRITICAL | 9.3 | 0.4% | 47 |
|
| CVE-2026-74899 | Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break out of the IsolatedPluginExecutor and run arbitrary OS commands. The restricted exec() environment still leaks live Python type objects, so an attacker walks the class hierarchy to reach system primitives despite the intended sandbox. Rated CVSS 4.0 9.3 (critical) and reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.3 | 0.3% | 47 |
|
| CVE-2026-74896 | Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions before 1.4.0, where the DangerousPatternVisitor AST analyzer fails to catch dunder-based attribute traversal. Because the library's security model is to safely execute untrusted plugin code, an attacker who can supply a plugin can chain __class__, __bases__, __subclasses__() and __globals__ to reach restricted functions and run arbitrary OS commands, fully defeating the sandbox. Reported by VulnCheck with a vendor patch available; no public exploit or CISA KEV listing was identified at time of analysis. | CRITICAL | 9.3 | 0.3% | 47 |
|
| CVE-2026-74900 | Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets an attacker reconstruct the KEM shared secret and decrypt all protected ciphertext once they obtain only 16 bytes of the private key. The flaw lives in pqc.py, where any post-quantum KEM decapsulation failure silently falls back to a 'simulation mode' that derives a deterministic secret from those 16 key bytes plus attacker-visible encapsulated-key data, rather than raising an error. Reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.3 | 0.3% | 47 |
|
| CVE-2026-81719 | Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-supplied plugin to run in the host process at import time. Because the plugin signature policy defaulted to WARN, an unsigned or unverifiable non-built-in plugin was compiled and executed before the runtime sandbox was installed, with only a bypassable AST denylist as a gate. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the flaw yields full code execution as the invoking user once a malicious plugin is loaded. | CRITICAL | 9.3 | 0.3% | 47 |
|
| CVE-2026-81701 | Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a denylist rather than an allowlist to identify built-in plugins, so unsigned plugins dropped into top-level plugins/ directories or unrecognized subdirectories evade signature verification entirely. An attacker who can place a malicious plugin along documented installation paths gains code execution inside the CLI process, exposing user passwords and cryptographic keys. No public exploit identified at time of analysis, and the CVSS 4.0 score is 9.3 (Critical), though the network vector conflicts with the local plugin-placement prerequisite. | CRITICAL | 9.3 | 0.3% | 47 |
|
| CVE-2026-74880 | Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from the keyserver and telemetry server accepting refresh tokens as GET query parameters. Because URLs are routinely written to server access logs, proxy/CDN logs, browser history, and forwarded in HTTP Referer headers, any party with access to those artifacts can harvest a valid refresh token and mint new access tokens, effectively bypassing authentication. Reported by VulnCheck; no public exploit identified at time of analysis and it is not on CISA KEV. | CRITICAL | 9.3 | 0.3% | 47 |
|
| CVE-2026-81698 | Arbitrary command execution in jahlives' openssl_encrypt before 1.4.9 arises when the tool's 'info' command reconstructs and prints a CLI invocation using untrusted metadata fields (such as pepper_name) without shell-quoting. An attacker who controls the metadata of an encrypted file can embed shell commands that run on the victim's system the moment the printed CLI block is copied and pasted into a terminal. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk hinges on the victim copy-pasting attacker-influenced output. | CRITICAL | 9.3 | 0.3% | 47 |
|
| CVE-2026-81700 | Signature verification bypass in openssl_encrypt (the jahlives Python encryption library) before version 1.4.9 lets attackers who possess a revoked or expired-but-formerly-trusted GPG signing key defeat plugin authenticity checks and run malicious code in the host process. The flaw lives in gpg_runner.verify_detached, which treats a VALIDSIG status line as success while ignoring REVKEYSIG, EXPKEYSIG, and gpg's own exit code. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, unauthenticated CVSS 4.0 score of 9.3 marks it as high priority for any deployment that loads signed plugins. | CRITICAL | 9.3 | 0.3% | 47 |
|
| CVE-2026-74901 | Authentication bypass in the openssl_encrypt Python library (versions before 1.4.0) lets attackers who can tamper with ciphertext in transit defeat integrity protection, because a failed AES-GCM authenticated decryption in pqc.py silently falls back to unauthenticated AES-CTR. Reported by VulnCheck and carrying a CVSS 4.0 base score of 9.3, the flaw enables undetected bit-flipping and ciphertext manipulation. No public exploit identified at time of analysis, but a vendor patch is available. | CRITICAL | 9.3 | 0.2% | 47 |
|