{"action":"Upgrade openssl-encrypt to 1.4.7 or later.","affected":[{"fixed":"1.4.7","introduced":"0"}],"component":"openssl-encrypt","cve_ids":["CVE-2026-74870"],"ecosystem":"PyPI","epss":0.00261,"exploited":false,"fixed_versions":["1.4.7"],"ghsa_id":"GHSA-p9g8-wvh4-2jmx","id":"tcs_01M5KH8X70NTY1Z2K7476ZZXZ7","modified_at":"2026-09-10T13:00:03.320612550Z","published_at":"2026-08-17T11:16:41.293Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3956","https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-p9g8-wvh4-2jmx","https://www.vulncheck.com/advisories/openssl-encrypt-before-hardware-pepper-information-disclosure"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-3956","url":"https://osv.dev/vulnerability/PYSEC-2026-3956"},{"source":"nvd","source_id":"CVE-2026-74870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74870"}],"summary":"openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardw"}