# Jahlives Openssl Encrypt vulnerabilities

Source: https://junglewise.ai/threats/technologies/openssl-encrypt  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/openssl-encrypt.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 49 vulnerabilities in Jahlives Openssl Encrypt: 0 in the last 7 days and 49 in the last 90 days, 10 of them critical and 0 exploited in the wild. The most recent, CVE-2026-81721, was published on 27 August 2026. Nothing was published in the last eight weeks.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 49
- All time: 49 (10 critical, 0 exploited in the wild)

## Latest Jahlives Openssl Encrypt vulnerabilities

- [CVE-2026-81721: openssl_encrypt KDF cost parameter validation bypass](https://junglewise.ai/threats/cve-2026-81721-openssl-encrypt-kdf-cost-parameter-validation-bypass) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81720: openssl_encrypt memory exhaustion in identity file protection block](https://junglewise.ai/threats/cve-2026-81720-openssl-encrypt-memory-exhaustion-in-identity-file-protection) (medium, CVSS 6.2, published 27 Aug 2026)
- [CVE-2026-81719: openssl_encrypt arbitrary code execution via plugin signature bypass](https://junglewise.ai/threats/cve-2026-81719-openssl-encrypt-arbitrary-code-execution-via-plugin-signature) (high, CVSS 7.8, published 27 Aug 2026)
- [CVE-2026-81718: openssl_encrypt weak PBKDF2 parameters in keyfile encryption](https://junglewise.ai/threats/cve-2026-81718-openssl-encrypt-weak-pbkdf2-parameters-in-keyfile-encryption) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81717: openssl_encrypt USB drive integrity bypass with fixed KDF salt](https://junglewise.ai/threats/cve-2026-81717-openssl-encrypt-usb-drive-integrity-bypass-with-fixed-kdf-salt) (medium, CVSS 4, published 27 Aug 2026)
- [CVE-2026-81716: openssl-encrypt path traversal in PluginSandbox](https://junglewise.ai/threats/cve-2026-81716-openssl-encrypt-path-traversal-in-pluginsandbox) (medium, CVSS 5.2, published 27 Aug 2026)
- [CVE-2026-81715: openssl-encrypt credential exposure in debug output](https://junglewise.ai/threats/cve-2026-81715-openssl-encrypt-credential-exposure-in-debug-output) (medium, CVSS 4, published 27 Aug 2026)
- [CVE-2026-81714: openssl-encrypt cryptographic signature verification bypass](https://junglewise.ai/threats/cve-2026-81714-openssl-encrypt-cryptographic-signature-verification-bypass) (high, CVSS 7, published 27 Aug 2026)
- [CVE-2026-81707: openssl_encrypt ANSI escape injection in identity email](https://junglewise.ai/threats/cve-2026-81707-openssl-encrypt-ansi-escape-injection-in-identity-email) (critical, CVSS 9.8, published 27 Aug 2026)
- [CVE-2026-81706: openssl_encrypt namespace collision in IdentityStore allowing key substitution](https://junglewise.ai/threats/cve-2026-81706-openssl-encrypt-namespace-collision-in-identitystore-allowing-key) (medium, CVSS 6.8, published 27 Aug 2026)
- [CVE-2026-81705: openssl-encrypt sensitive information in debug logs](https://junglewise.ai/threats/cve-2026-81705-openssl-encrypt-sensitive-information-in-debug-logs) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81704: openssl_encrypt weak key derivation in D-Bus EncryptFile handler](https://junglewise.ai/threats/cve-2026-81704-openssl-encrypt-weak-key-derivation-in-d-bus-encryptfile-handler) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81703: openssl_encrypt authentication bypass in post-quantum key validation](https://junglewise.ai/threats/cve-2026-81703-openssl-encrypt-authentication-bypass-in-post-quantum-key) (medium, CVSS 5.5, published 27 Aug 2026)
- [CVE-2026-81702: openssl_encrypt key substitution in identity loading](https://junglewise.ai/threats/cve-2026-81702-openssl-encrypt-key-substitution-in-identity-loading) (critical, CVSS 9.8, published 27 Aug 2026)
- [CVE-2026-81701: openssl_encrypt signature verification bypass via denylist](https://junglewise.ai/threats/cve-2026-81701-openssl-encrypt-signature-verification-bypass-via-denylist) (critical, CVSS 9.8, published 27 Aug 2026)
- [CVE-2026-81700: openssl_encrypt GPG signature verification bypass in gpg_runner](https://junglewise.ai/threats/cve-2026-81700-openssl-encrypt-gpg-signature-verification-bypass-in-gpg-runner) (critical, CVSS 9.8, published 27 Aug 2026)
- [CVE-2026-81699: openssl_encrypt unbounded KDF cost denial of service](https://junglewise.ai/threats/cve-2026-81699-openssl-encrypt-unbounded-kdf-cost-denial-of-service) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81698: openssl_encrypt shell injection in info command](https://junglewise.ai/threats/cve-2026-81698-openssl-encrypt-shell-injection-in-info-command) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81697: openssl-encrypt KDF downgrade via CWD-relative configuration](https://junglewise.ai/threats/cve-2026-81697-openssl-encrypt-kdf-downgrade-via-cwd-relative-configuration) (medium, CVSS 5.5, published 27 Aug 2026)
- [CVE-2026-81696: openssl_encrypt terminal injection in info command](https://junglewise.ai/threats/cve-2026-81696-openssl-encrypt-terminal-injection-in-info-command) (medium, CVSS 4, published 27 Aug 2026)
- [CVE-2026-81695: openssl_encrypt terminal injection in decrypt auto-detection](https://junglewise.ai/threats/cve-2026-81695-openssl-encrypt-terminal-injection-in-decrypt-auto-detection) (medium, CVSS 4, published 27 Aug 2026)
- [CVE-2026-81694: openssl-encrypt output injection via unsanitized filenames](https://junglewise.ai/threats/cve-2026-81694-openssl-encrypt-output-injection-via-unsanitized-filenames) (medium, CVSS 4, published 27 Aug 2026)
- [CVE-2026-81693: openssl_encrypt unbounded memory allocation in QR JSON parsing](https://junglewise.ai/threats/cve-2026-81693-openssl-encrypt-unbounded-memory-allocation-in-qr-json-parsing) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81692: openssl_encrypt memory allocation denial of service in FLAC parsing](https://junglewise.ai/threats/cve-2026-81692-openssl-encrypt-memory-allocation-denial-of-service-in-flac) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81691: openssl_encrypt unvalidated server URL in login and register_with_email](https://junglewise.ai/threats/cve-2026-81691-openssl-encrypt-unvalidated-server-url-in-login-and-register-with) (high, CVSS 7.5, published 27 Aug 2026)

## Most severe Jahlives Openssl Encrypt vulnerabilities

- [CVE-2026-74878: openssl-encrypt: TOTP rate limiter is in-memory only , not shared across workers, lost on restart](https://junglewise.ai/threats/cve-2026-74878-openssl-encrypt-totp-rate-limiter-is-in-memory-only-not-shared) (critical, CVSS 9.8, published 17 Aug 2026)
- [CVE-2026-74886: openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks…](https://junglewise.ai/threats/cve-2026-74886-pysec-2026-3763-openssl-encrypt-versions-before-1-4-0-contain-a) (critical, CVSS 9.8, published 17 Aug 2026)
- [CVE-2026-74872: openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification](https://junglewise.ai/threats/cve-2026-74872-openssl-encrypt-dynamic-so-loading-for-whirlpool-uses-broad-glob) (critical, CVSS 9.8, published 17 Aug 2026)
- [CVE-2026-81707: openssl_encrypt ANSI escape injection in identity email](https://junglewise.ai/threats/cve-2026-81707-openssl-encrypt-ansi-escape-injection-in-identity-email) (critical, CVSS 9.8, published 27 Aug 2026)
- [CVE-2026-74880: openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage](https://junglewise.ai/threats/cve-2026-74880-openssl-encrypt-accepts-refresh-tokens-as-url-query-parameters) (critical, CVSS 9.8, published 17 Aug 2026)
- [CVE-2026-81701: openssl_encrypt signature verification bypass via denylist](https://junglewise.ai/threats/cve-2026-81701-openssl-encrypt-signature-verification-bypass-via-denylist) (critical, CVSS 9.8, published 27 Aug 2026)
- [CVE-2026-81700: openssl_encrypt GPG signature verification bypass in gpg_runner](https://junglewise.ai/threats/cve-2026-81700-openssl-encrypt-gpg-signature-verification-bypass-in-gpg-runner) (critical, CVSS 9.8, published 27 Aug 2026)
- [CVE-2026-74876: openssl-encrypt's unverified key bundle from_dict() + to_identity() path allows encryption to attacker keys](https://junglewise.ai/threats/cve-2026-74876-openssl-encrypt-s-unverified-key-bundle-from-dict-to-identity) (critical, CVSS 9.8, published 17 Aug 2026)
- [CVE-2026-74875: openssl-encrypt silently skips schema validation when jsonschema library is not installed](https://junglewise.ai/threats/cve-2026-74875-openssl-encrypt-silently-skips-schema-validation-when-jsonschema) (critical, CVSS 9.8, published 17 Aug 2026)
- [CVE-2026-81702: openssl_encrypt key substitution in identity loading](https://junglewise.ai/threats/cve-2026-81702-openssl-encrypt-key-substitution-in-identity-loading) (critical, CVSS 9.8, published 27 Aug 2026)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 13 | 6 | 0 |
| 24 Aug 2026 | 36 | 4 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Jahlives Openssl Encrypt vulnerabilities", https://junglewise.ai/threats/technologies/openssl-encrypt, 9 November 2026.