https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 06:47:06 +0000 https://vulnerability.circl.lu/vuln/cve-2026-81705 <p><strong>Affected:</strong> jahlives openssl_encrypt</p> <p>openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2&gt;&amp;1 output, CI job logs, or the GUI&#39;s persistent debug log) can recover the password.</p> <p><strong>Affected:</strong> jahlives openssl_encrypt</p> <p>openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2&gt;&amp;1 output, CI job logs, or the GUI&#39;s persistent debug log) can recover the password.</p> https://vulnerability.circl.lu/vuln/cve-2026-81705