jahlives has 66 CVEs on record. Disclosure cadence is accelerating: 66 in the last 90 days against 0 in the 90 before. The busiest recent month was August 2026 with 66. The median CVSS is 7.5 (high), with 18 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-347 (7) and CWE-345 (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 66 prev 0
Worst active — by depth score
CVE-2026-74899Critical· 9.8openssl_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy66CVE-2026-74896Critical· 9.8openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal66CVE-2026-74883High· 8.8openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and io60CVE-2026-81707Critical· 9.8openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users54CVE-2026-81702Critical· 9.8openssl_encrypt before 1.4.9 Key Substitution via Identity Load54
jahlives vulnerabilities
CVEs affecting jahlives, newest first. Open any entry for full detail, references, and exploit status.
66 CVEsRSS
CVE-2026-74873Medium· 5.5openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users
openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plai…
CVE-2026-74881Medium· 6.5⚖ disputedopenssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true
openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of …
CVE-2026-74876Critical· 9.8openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures
openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without sign…
CVE-2026-74880Critical· 9.8openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes
openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain un…
CVE-2026-74875Critical· 9.8openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata f…
CVE-2026-74879High· 7.5openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers
openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensit…