最近六个月的全部 CVE，每天更新。

显示 17 条中的 17 条

• 中CVE-2026-92757CVSS 评分 5.52026年9月17日

  Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.

  CWE-311
• 中CVE-2026-92756CVSS 评分 5.52026年9月17日

  Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the databas

  CWE-311
• 中CVE-2026-84676CVSS 评分 4.32026年9月2日

  Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

  CWE-311
• 高CVE-2026-81688CVSS 评分 7.52026年8月27日

  openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separ

  CWE-311jahlives openssl_encrypt
• 中CVE-2026-81681CVSS 评分 4.62026年8月27日

  openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored

  CWE-311jahlives openssl_encrypt
• 严重CVE-2026-77812CVSS 评分 9.42026年8月21日

  DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly applicati

  CWE-311
• 低CVE-2026-19891CVSS 评分 3.72026年8月15日

  A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchange_mode causes missing encryption of sensitive da

  CWE-310CWE-311
• 高CVE-2025-59325CVSS 评分 7.52026年8月12日

  CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details.

  CWE-311
• 中CVE-2026-21079CVSS 评分 6.52026年8月10日

  Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.

  CWE-311samsung smart_switch
• 高CVE-2026-20157CVSS 评分 7.52026年7月15日

  As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d

  CWE-311cisco roomoscisco roomos_cloud
• 高CVE-2025-63579CVSS 评分 7.52026年7月9日

  Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming data ian be bypassed with this vulnerability, allowing encrypted data to be decrypted. Passwords and oth

  CWE-200CWE-284CWE-311
• 高CVE-2026-54784CVSS 评分 7.42026年7月8日

  CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows cl

  CWE-311CWE-523
• 中CVE-2026-55568CVSS 评分 5.92026年6月23日

  Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the proxy is transmitted in cleartext. Proxy authentication credentials (the Proxy-Authorization header, proxy userinfo i

  CWE-311CWE-319CWE-636guzzlephp guzzle
• 中CVE-2026-53442CVSS 评分 5.32026年6月10日

  Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Ext

  CWE-311jenkins jenkins
• 高CVE-2026-34486CVSS 评分 7.52026年4月9日

  Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.2

  CWE-311CWE-807apache tomcatredhat jboss_web_serverredhat enterprise_linux
• 高CVE-2026-34992CVSS 评分 7.52026年4月6日

  Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to 2.4.5 and 2.5.2, a missing encryption vulnerability affects inter-Node Pod traffic. In Antrea clusters configured for dual-stack networking with IPsec encryption enabled (tra

  CWE-311linuxfoundation antrea
• 严重CVE-2026-32891CVSS 评分 9.02026年3月20日

  Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to

  CWE-80CWE-212CWE-311openvessl anchorr