CVE-2026-25250 | Medium | 6.0 | 2026-08-27 | EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable." |
CVE-2026-76784 | | | 2026-08-26 | Multiple
TP-Link Kasa smart home devices contain insufficient cryptographic protections
in the local device communication protocol. An adjacent network attacke… |
CVE-2026-17666 | Critical | 9.1 | 2026-07-30 | Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discretionary access co… |
CVE-2026-59776 | Medium | 6.8 | 2026-07-21 | Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is exploited, information… |
CVE-2026-58638 | Medium | 6.0 | 2026-07-14 | Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a security feature locally. |
CVE-2026-55144 | High | 7.1 | 2026-07-14 | Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally. |
CVE-2026-6458 | | | 2026-06-24 | Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming AES-256-GCM… |
CVE-2026-49440 | High | 7.4 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, options][, callback]) and crypto.checkPrimeSync(c… |
CVE-2026-9266 | | | 2026-06-12 | A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulner… |
CVE-2026-45446 | Medium | 4.8 | 2026-06-09 | Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV
(RFC 8452) mishandle the authentication of AAD (Additional Authenticated
Data) with an… |
CVE-2026-45445 | High | 7.5 | 2026-06-09 | Issue summary: When an application drives an AES-OCB context through the
public EVP_Cipher() one-shot interface, the application-supplied
initialisation vector… |
CVE-2026-42770 | Low | 3.7 | 2026-06-09 | Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42)
peer key, the peer key is not properly checked for the subgroup membership.
Impact… |
CVE-2026-0420 | Medium | 5.9 | 2026-06-09 | An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attacker to perform attack… |
CVE-2026-48480 | | | 2026-06-04 | The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked… |
CVE-2026-42246 | High | 7.4 | 2026-05-09 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-mi… |
CVE-2026-41395 | High | 7.5 | 2026-04-28 | OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashe… |
CVE-2026-40542 | High | 7.3 | 2026-04-22 | Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper m… |
CVE-2026-29142 | Medium | 5.3 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to forge a GINA-encrypted email. |
CVE-2026-4601 | High | 8.7 | 2026-03-23 | Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA sig… |
CVE-2026-4258 | High | 7.5 | 2026-03-17 | Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.e… |
CVE-2026-28498 | High | 7.5 | 2026-03-16 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib… |
CVE-2025-47383 | High | 7.2 | 2026-03-02 | Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE. |
CVE-2025-69418 | Medium | 4.0 | 2026-01-27 | Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 1… |
CVE-2026-22863 | High | 7.5 | 2026-01-15 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to have infi… |
CVE-2025-60704 | High | 7.5 | 2025-11-11 | Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-59339 | Medium | 4.4 | 2025-09-17 | The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provi… |
CVE-2025-58359 | | | 2025-09-05 | ZF FROST is a Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures). In versions 2.0.0 through 2.1.0, refresh shares with smalle… |
CVE-2025-49600 | Medium | 4.9 | 2025-07-04 | In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leigh… |
CVE-2015-20112 | Low | 3.4 | 2025-06-29 | RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network. |
CVE-2025-5323 | Low | 3.7 | 2025-05-29 | A vulnerability, which was classified as problematic, has been found in fossasia open-event-server 1.19.1. This issue affects the function send_email_change_us… |
CVE-2025-3938 | Medium | 6.8 | 2025-05-22 | Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows… |
CVE-2025-30147 | | | 2025-05-07 | Besu Native contains scripts and tooling that is used to build and package the native libraries used by the Ethereum client Hyperledger Besu. Besu 24.7.1 throu… |
CVE-2024-55655 | | | 2024-12-10 | sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insu… |
CVE-2022-20793 | Medium | 6.8 | 2024-11-15 | A vulnerability in pairing process of Cisco TelePresence CE Software and RoomOS Software for Cisco Touch 10 Devices could allow an unauthenticated, r… |
CVE-2024-43547 | Medium | 6.5 | 2024-10-08 | Windows Kerberos Information Disclosure Vulnerability |
CVE-2023-39199 | Medium | 4.9 | 2023-11-14 | Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access. |
CVE-2023-46129 | High | 7.5 | 2023-10-31 | NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptogra… |
CVE-2023-40012 | Medium | 5.9 | 2023-08-09 | uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Versions of uthenticode prior to the 2.x series did not… |
CVE-2023-34471 | Medium | 6.3 | 2023-07-05 |
AMI SPx contains a vulnerability in the BMC where a user may cause a missing cryptographic step by generating a hash-based message authentication code (HMAC)… |
CVE-2023-36539 | Medium | 5.3 | 2023-06-30 | Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information. |
CVE-2023-28999 | Medium | 6.9 | 2023-04-04 | Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS… |
CVE-2023-28998 | Medium | 6.7 | 2023-04-04 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server a… |
CVE-2022-24116 | Critical | 9.8 | 2022-12-26 | Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0. |
CVE-2022-30115 | Medium | 4.3 | 2022-06-02 | Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. Thi… |
CVE-2022-29229 | Medium | 6.3 | 2022-05-18 | CaSS is a Competency and Skills System. CaSS Library, (npm:cassproject) has a missing cryptographic step when storing cryptographic keys that can allow a serve… |
CVE-2022-20742 | High | 7.4 | 2022-05-03 | A vulnerability in an IPsec VPN library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an un… |
CVE-2022-1279 | Medium | 6.5 | 2022-04-14 | A vulnerability in the encryption implementation of EBICS messages in the open source librairy ebics-java/ebics-java-client allows an attacker sniffing network… |
CVE-2021-31386 | Medium | 5.3 | 2021-10-19 | A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-… |
CVE-2021-22946 | High | 7.5 | 2021-09-29 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command l… |
CVE-2021-3680 | Medium | 4.9 | 2021-08-04 | showdoc is vulnerable to Missing Cryptographic Step |
CVE-2021-33560 | High | 7.5 | 2021-06-08 | Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_pow… |
CVE-2020-26244 | Medium | 6.8 | 2020-12-02 | Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client imple… |
CVE-2020-15098 | High | 8.8 | 2020-07-29 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an inte… |
CVE-2020-15086 | Critical | 9.8 | 2020-07-29 | In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism… |
CVE-2020-10702 | Medium | 5.5 | 2020-06-04 | A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A ge… |
CVE-2019-3738 | Medium | 6.5 | 2019-09-18 | RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially… |
CVE-2018-5383 | Medium | 6.8 | 2018-08-07 | Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before t… |
CVE-2016-9574 | Medium | 5.9 | 2018-07-19 | nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA. |
CVE-2017-2598 | Medium | 4.3 | 2018-05-23 | Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to… |
CVE-2017-2603 | Low | 2.6 | 2018-05-15 | Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API token… |
CVE-2017-2600 | Medium | 4.3 | 2018-05-15 | In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and ru… |