CVE-2026-8881

HighCVSS 7.5/10Last modified Jul 22, 2026

Description

Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration for AES encryption. MD5 has been broken since 2004 and a single iteration provides no key stretching.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
Securly	Securly Chrome Extension	<= 3.0.7

References

https://kb.cert.org/vuls/id/595768Third Party Advisory, VDB Entry

Timeline

Published: Jun 3, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-888107.2A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRo CVE-2026-888119.1Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This aff CVE-2026-888127.8A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a c CVE-2026-888135.3The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount act CVE-2026-888143.7The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed CVE-2026-888156.2DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type CVE-2026-888167.5DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointe CVE-2026-888178.7An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group w CVE-2026-888196.3In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.CVE-2026-88826.4The WP ApplicantStack Jobs Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all version CVE-2026-88822Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is CVE-2026-88823Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supp