https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:03:01.692438+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-81689 CVE-2026-81689 — openssl_encrypt before 1.4.9 Weak Pepper Key Derivation 2026-10-03T14:03:01.711122+00:00

Affected: jahlives openssl_encrypt

openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.