Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.
Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tabExplore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.
Recent security developmentsDell PowerStore contains a use-of-broken-cryptography vulnerability. A low-privileged attacker could exploit it to impersonate another identity, potentially leading to unauthorized access.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Dell PowerStore contains a use of a weak cryptographic algorithm vulnerability that could allow an attacker with existing privileged access to the appliance to recover stored credentials.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
CAI Content Credentials is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Use of a broken or risky cryptographic algorithm in SQL Server allows an unauthorized attacker to disclose information over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Use of a broken or risky cryptographic algorithm in Windows DPAPI (Data Protection Application Programming Interface) allows an authorized attacker to elevate privileges locally.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 could allow a local attacker to obtain sensitive information due to the use of a weak cryptographic algorithm.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.
No structured fix or guidance is available here. Check the latest publisher advisory.
Public exploit reference
The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
