{"action":"Upgrade openssl-encrypt to 1.4.0 or later.","affected":[{"fixed":"1.4.0","introduced":"0"}],"component":"openssl-encrypt","cve_ids":["CVE-2026-74887"],"ecosystem":"PyPI","epss":0.00299,"exploited":false,"fixed_versions":["1.4.0"],"ghsa_id":"GHSA-cx72-m6xj-3vf6","id":"tcs_01M5KH735AKYGGJ6FEQ3CXPYEH","modified_at":"2026-09-01T09:15:03.524450805Z","published_at":"2026-08-17T11:16:43.523Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3745","https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-cx72-m6xj-3vf6","https://www.vulncheck.com/advisories/openssl-encrypt-before-insecure-random-import-in-pqc-module"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"PYSEC-2026-3745","url":"https://osv.dev/vulnerability/PYSEC-2026-3745"}],"summary":"openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the co"}