| CVE ID | Description | CVSS | Priority | Trend | Exploit | Patch |
|---|---|---|---|---|---|---|
| CVE ID | Description | CVSS | Priority | Trend | Exploit | Patch |
|---|---|---|---|---|---|---|
Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
Known vulnerabilities affecting Openssl products and systems
| CVE ID | Description | CVSS | Priority | Trend | Exploit | Patch |
|---|---|---|---|---|---|---|
| CVE-2026-9076 | Multiple NetApp products incorporate OpenSSL. OpenSSL versions 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Se... | 7.5 | 471 | Neutral | No |
| Yes |
| CVE-2026-84784 | OpenSSL versions 4.0, 3.6, 3.5 and 3.4 are susceptible to a vulnerability which when successfully exploited could allow the local QUIC stack to send a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID ... | 7.5 | 386 | Neutral | No | Yes |
| CVE-2026-84783 | OpenSSL version 4.0 is susceptible to a vulnerability which when successfully exploited could lead to a use-after-free read, which is likely to crash the process, resulting in a Denial of Service (DoS... | 7.5 | 514 | Neutral | No | Yes |
| CVE-2026-84782 | OpenSSL versions 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are susceptible to a vulnerability which when successfully exploited can disclose a heap memory to the peer as plaintext handshake data via a ... | 8.2 | 581 | Neutral | No | Yes |
| CVE-2026-81721 | openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malic... | 7.5 | 386 | Neutral | No | Yes |
| CVE-2026-81720 | openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers w... | 6.2 | 181 | Neutral | No | Yes |
| CVE-2026-81719 | openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compi... | 7.8 | 594 | Neutral | No | Yes |
| CVE-2026-81717 | openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical... | 3.5 | 102 | Neutral | No | Yes |
| CVE-2026-81716 | openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a bare string-prefix match. A sandboxed pl... | 5.2 | 238 | Neutral | No | Yes |
| CVE-2026-81715 | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sa... | 3.3 | 95 | Neutral | No | Yes |
| CVE-2026-81714 | openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forg... | 7.0 | 287 | Neutral | No | Yes |
| CVE-2026-81706 | openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corre... | 6.8 | 253 | Neutral | No | Yes |
| CVE-2026-81705 | openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option sp... | 7.5 | 386 | Neutral | No | Yes |
| CVE-2026-81704 | openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perfor... | 7.5 | 450 | Neutral | No | Yes |
| CVE-2026-81703 | openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decry... | 5.5 | 125 | Neutral | No | Yes |
| CVE-2026-81702 | openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can rep... | 9.8 | 588 | Neutral | No | Yes |
| CVE-2026-81701 | openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature ve... | 9.8 | 588 | Neutral | No | Yes |
| CVE-2026-81700 | openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspec... | 9.8 | 588 | Neutral | No | Yes |
| CVE-2026-81699 | openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authenticat... | 7.5 | 386 | Neutral | No | Yes |
| CVE-2026-81698 | openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can c... | 8.8 | 708 | Neutral | No | Yes |