CVE-2026-28252 is a critical vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge systems caused by the use of a broken or risky cryptographic algorithm. This flaw enables attackers to bypass authentication mechanisms and gain root-level access without requiring user interaction or prior privileges. The vulnerability has a high CVSS 4.0 score of 9.2, reflecting its severe impact on confidentiality, integrity, and availability. Although no known exploits are currently in the wild, the risk remains significant due to the critical nature of the affected systems, which are widely used in building automation and HVAC control. The vulnerability requires network access but has a high attack complexity, meaning exploitation is possible but may require some effort. Organizations using these Trane products should prioritize patching or mitigating this issue to prevent unauthorized control of critical infrastructure components. Countries with extensive deployment of Trane building management systems and critical infrastructure reliance on HVAC automation are at heightened risk. Immediate mitigation steps include network segmentation, restricting access to management interfaces, and monitoring for anomalous authentication attempts.
An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access.
Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension diversity, allowing Deep Packet Inspection (DPI) systems to trivially identify and block proxy traffic, undermining censorship circumvention. (CWE-327)
Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Config import, URI scheme handler, CLI --config modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program files flutter/lib/common.Dart, hbb_common/src/config.Rs and program routines parseRustdeskUri(), importConfig().
This issue affects RustDesk Client: through 1.4.5.
Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro on Windows, MacOS, Linux (Config string generation, web console export modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program routines Config export/generation routines.
This issue affects RustDesk Server Pro: through 1.7.5.
IBM Aspera faspio Gateway 1.3.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information
An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of the SSH session, allowing manipulation of transmitted data if the attacker can interact with the network traffic.
An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH communication, if they are able to intercept or interact with the network traffic.
An authentication bypass vulnerability exists in Copeland XWEB Pro
version 1.12.1 and prior, enabling any attackers to bypass the
authentication requirement and achieve pre-authenticated code execution
on the system.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with `alg: "none"` to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected. The fix in versions 8.6.3 and 9.1.1-alpha.4 hardcodes the expected `RS256` algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with `jwks-rsa` which rejects unknown key IDs. As a workaround, dsable Google authentication until upgrading is possible.
Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded in client-side JavaScript. Because the key is static and exposed, an attacker can decrypt protected values and defeat confidentiality protections.
IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational cost controls, enabling attackers who obtain password hashes through database exposure, backup leakage, or other compromise vectors to rapidly recover plaintext credentials via offline attacks.
CVE-2025-66597 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue arises from the use of weak cryptographic algorithms, which can allow attackers to decrypt communications between clients and the web server. This vulnerability requires no authentication or user interaction and can be exploited remotely over the network. While no known exploits are currently in the wild, the weakness poses a significant risk to confidentiality and potentially integrity of data transmitted. European organizations using FAST/TOOLS in critical industrial control or monitoring environments could face data exposure or interception risks. Mitigation involves upgrading to patched versions once available or applying compensating controls such as network segmentation and encrypted tunnels. Countries with significant industrial automation sectors and Yokogawa customer bases, such as Germany, France, Italy, and the UK, are most likely to be affected. Due to the critical nature of industrial control systems, this vulnerability demands prompt attention to prevent potential espionage or sabotage.
CVE-2025-66598 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue arises from the product's support for outdated SSL/TLS protocols, which use broken or risky cryptographic algorithms (CWE-327). This flaw potentially allows attackers to decrypt communications between clients and the web server, compromising confidentiality. The vulnerability requires no user interaction and can be exploited remotely without authentication, increasing its risk. Although no known exploits are currently active in the wild, the vulnerability's presence in critical industrial control system software raises significant concerns. European organizations using FAST/TOOLS in sectors like energy, manufacturing, and utilities are at risk. Mitigation involves disabling legacy SSL/TLS versions, applying vendor patches once available, and implementing network-level protections. Countries with substantial industrial automation deployments, such as Germany, France, Italy, and the UK, are most likely to be affected.
Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of the Parsec application, does not check for weak order point of Curve25519 when compiled with its RustCrypto backend. In practice this means an attacker in a man-in-the-middle position would be able to provide weak order points to both parties in the Diffie-Hellman exchange, resulting in a high probability to for both parties to obtain the same shared key (hence leading to a successful SAS code exchange, misleading both parties into thinking no MITM has occurred) which is also known by the attacker. Note only Parsec web is impacted (as Parsec desktop uses `libparsec_crypto` with the libsodium backend). Version 3.6.0 of Parsec patches the issue.
CVE-2026-24785 is a high-severity vulnerability in the Clatter Rust library, a no_std compatible implementation of the Noise protocol framework with post-quantum support. Versions prior to 2.2.0 allow the use of post-quantum handshake patterns that violate the PSK validity rule, enabling PSK-derived keys to be used without proper ephemeral randomness. This cryptographic flaw weakens security guarantees and risks catastrophic key reuse. The affected handshake patterns include several default `*_psk0` variants and some hybrid patterns. The issue is addressed in Clatter v2.2.0, which adds runtime checks to prevent insecure handshake patterns. Organizations using vulnerable versions and affected patterns may have compromised handshake security, risking confidentiality and integrity of communications.
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
Use of a Broken or Risky Cryptographic Algorithm (DES) vulnerability
in the Password class in C2SConnections.dll in Milner ImageDirector Capture on Windows allows Encryption Brute Forcing to obtain database credentials.This issue affects ImageDirector Capture: from 7.0.9.0 before 7.6.3.25808.
