CVE-2026-65777 | Medium | 5.3 | 2026-08-11 | Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network. |
CVE-2026-9201 | High | 8.8 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component v… |
CVE-2026-59651 | | | 2026-08-03 | In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS be… |
CVE-2026-4648 | | | 2026-07-28 | Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. (version used at Resur… |
CVE-2026-50044 | Medium | 6.8 | 2026-07-23 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials vi… |
CVE-2026-49852 | | | 2026-07-17 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode… |
CVE-2024-23564 | Critical | 9.1 | 2026-07-17 | HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redire… |
CVE-2026-35146 | Medium | 6.3 | 2026-07-16 | HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via t… |
CVE-2026-45363 | Critical | 9.1 | 2026-07-14 | ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') acc… |
CVE-2025-63579 | High | 7.5 | 2026-07-09 | Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming dat… |
CVE-2026-14868 | Medium | 5.5 | 2026-07-07 | The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of PcVue projects, all versions prior to 17… |
CVE-2026-7830 | High | 7.4 | 2026-07-01 | UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC_MsLogonIIAuth). In rfb/dh.cpp the Diffie-Hellman ke… |
CVE-2026-41860 | High | 8.8 | 2026-06-04 | CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #s… |
CVE-2026-8878 | High | 7.5 | 2026-06-03 | Version 3.0.7 of the Securly Chrome Extension exposes multiple publicly accessible endpoints that allow unauthenticated access to sensitive data. The exposed i… |
CVE-2026-45787 | Critical | 9.1 | 2026-05-28 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, const… |
CVE-2026-44523 | Critical | 10.0 | 2026-05-14 | Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The appli… |
CVE-2026-44351 | Critical | 9.1 | 2026-05-13 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flo… |
CVE-2026-33361 | High | 7.5 | 2026-05-11 | In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x)… |
CVE-2018-25272 | Critical | 9.8 | 2026-04-22 | ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commands with SYSTEM leve… |
CVE-2025-1241 | Medium | 5.8 | 2026-04-21 | Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users t… |
CVE-2026-5363 | High | 8.8 | 2026-04-16 | Inadequate Encryption Strength vulnerability in TP-Link Archer C7 v5 and v5.8 (uhttpd modules) allows Password Recovery Exploitation. The web interface encrypt… |
CVE-2026-5889 | Medium | 4.3 | 2026-04-08 | Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a br… |
CVE-2026-39349 | Low | 2.7 | 2026-04-07 | OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB m… |
CVE-2026-28377 | High | 7.5 | 2026-03-26 | A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users… |
CVE-2026-33512 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication… |
CVE-2026-33488 | High | 7.4 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `createKeys()` function in the LoginControl plugin's PGP 2FA system gen… |
CVE-2025-36379 | Medium | 5.9 | 2026-02-17 | IBM Security QRadar EDR 3.12 through 3.12.23 IBM Security ReaQta uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt hig… |
CVE-2025-68703 | High | 7.5 | 2026-01-13 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encrypt… |
CVE-2026-0510 | Low | 3.0 | 2026-01-13 | The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographic algorithm for encrypting User Mapping… |
CVE-2025-65295 | High | 8.1 | 2025-12-10 | Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attacker… |
CVE-2025-41743 | Medium | 4.0 | 2025-12-02 | Insufficient encryption strength in Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 allows a local unprivileged attacker to extract data from up… |
CVE-2025-11935 | High | 7.5 | 2025-11-21 | With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue on with… |
CVE-2025-12439 | Medium | 5.5 | 2025-11-10 | Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitiv… |
CVE-2025-12478 | Critical | 9.8 | 2025-10-29 | Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-55039 | Medium | 6.5 | 2025-10-15 | This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0.
Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network… |
CVE-2025-55248 | Medium | 4.8 | 2025-10-14 | Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network. |
CVE-2025-39889 | High | 8.1 | 2025-09-24 | In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: l2cap: Check encryption key size on incoming connection
This is required for p… |
CVE-2025-46409 | High | 7.5 | 2025-08-28 | Inadequate encryption strength issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If this vulnerability is exploited, a functio… |
CVE-2025-9513 | Low | 3.7 | 2025-08-27 | A flaw has been found in editso fuso up to 1.0.4-beta.7. This affects the function PenetrateRsaAndAesHandshake of the file src/net/penetrate/handshake/mod.rs… |
CVE-2025-9239 | Low | 3.7 | 2025-08-20 | A vulnerability was identified in elunez eladmin up to 2.7. Affected by this vulnerability is the function EncryptUtils of the file eladmin-common/src/main/jav… |
CVE-2025-45765 | Critical | 9.1 | 2025-08-07 | ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is "keysize is not something that is enforced by this library… |
CVE-2025-45764 | Low | 3.2 | 2025-08-06 | jsrsasign v11.1.0 was discovered to contain weak encryption. NOTE: this issue has been disputed by a third party who believes that CVE IDs can be assigned for… |
CVE-2025-45770 | High | 7.0 | 2025-07-31 | jwt v5.4.3 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application… |
CVE-2025-45769 | Medium | 6.5 | 2025-07-31 | php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an applic… |
CVE-2025-36106 | Medium | 6.5 | 2025-07-21 | IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to view and modify information coming to and from the application which cou… |
CVE-2025-7789 | Low | 3.7 | 2025-07-18 | A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/j… |
CVE-2025-7398 | Critical | 9.1 | 2025-07-17 | Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036. |
CVE-2025-32874 | High | 7.5 | 2025-07-16 | An issue was discovered in Kaseya Rapid Fire Tools Network Detective through 2.0.16.0. A vulnerability exists in the EncryptionUtil class because symmetric enc… |
CVE-2025-48823 | Medium | 5.9 | 2025-07-08 | Cryptographic issues in Windows Cryptographic Services allows an unauthorized attacker to disclose information over a network. |
CVE-2025-27460 | High | 7.6 | 2025-07-03 | The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the d… |
CVE-2025-48960 | Medium | 5.9 | 2025-06-04 | Weak server key used for TLS encryption. The following products are affected: Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39938. |
CVE-2025-43925 | Medium | 4.6 | 2025-06-03 | An issue was discovered in Unicom Focal Point 7.6.1. The database is encrypted with a hardcoded key, making it easier to recover the cleartext data. |
CVE-2024-38341 | Medium | 5.9 | 2025-05-28 | IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that… |
CVE-2025-4894 | Low | 3.7 | 2025-05-18 | A vulnerability classified as problematic was found in calmkart Django-sso-server up to 057247929a94ffc358788a37ab99e391379a4d15. This vulnerability affects th… |
CVE-2025-27524 | Medium | 5.3 | 2025-05-15 | Weak encryption vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart D… |
CVE-2025-22446 | Medium | 4.6 | 2025-05-13 | Inadequate encryption strength for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable esca… |
CVE-2025-46833 | | | 2025-05-08 | Programs/P73_SimplePythonEncryption.py illustrates a simple Python encryption example using the RSA Algorithm. In versions prior to commit 6ce60b1, an attacker… |
CVE-2025-20667 | High | 7.5 | 2025-05-05 | In Modem, there is a possible information disclosure due to incorrect error handling. This could lead to remote information disclosure, if a UE has connected t… |
CVE-2025-46626 | High | 7.3 | 2025-05-01 | Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 allows an attacker t… |
CVE-2024-42177 | Low | 2.6 | 2025-04-17 | HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities. Attackers can exploit the weakness in the ciphers to intercept a… |
CVE-2025-2516 | | | 2025-03-27 | The use of a weak cryptographic key pair in the signature verification process in WPS Office (Kingsoft) on Windows allows an attacker who successfully recovere… |
CVE-2025-2349 | Low | 3.1 | 2025-03-16 | A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2024-54089 | High | 7.5 | 2025-02-11 | A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC Series (BACnet) (All… |
CVE-2024-10026 | Medium | 5.3 | 2025-01-30 | A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot ident… |
CVE-2024-13454 | Medium | 5.3 | 2025-01-20 | Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when created using OpenS… |
CVE-2024-13026 | | | 2025-01-17 | A vulnerability exists in Algo Edge up to 2.1.1 - a previously used (legacy) component of navify® Algorithm Suite. The vulnerability impacts the authenticatio… |
CVE-2024-45719 | Low | 2.6 | 2024-11-22 | Inadequate Encryption Strength vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.4.0.
The ids generated using the UUID v1 version a… |
CVE-2024-52318 | Medium | 6.1 | 2024-11-18 | Incorrect object recycling and reuse vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96.
Users are recommended to upgr… |
CVE-2024-52317 | Medium | 6.5 | 2024-11-18 | Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests
could lead to r… |
CVE-2024-43382 | Medium | 5.9 | 2024-10-30 | Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypted stage without t… |
CVE-2024-50550 | High | 8.1 | 2024-10-29 | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed… |
CVE-2024-45259 | Medium | 6.5 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing t… |
CVE-2023-6728 | Low | 3.3 | 2024-10-17 | Nokia SR OS bof.cfg file encryption is vulnerable to a brute force attack. This weakness allows an attacker in possession of the encrypted file to decrypt the… |
CVE-2024-45273 | High | 8.4 | 2024-10-15 | An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. |
CVE-2024-41594 | High | 7.5 | 2024-10-03 | An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI use… |
CVE-2024-33662 | High | 7.5 | 2024-10-02 | Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function. |
CVE-2024-8455 | High | 8.1 | 2024-09-30 | The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communicat… |
CVE-2024-47182 | Medium | 4.8 | 2024-09-27 | Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to… |
CVE-2024-22892 | High | 7.5 | 2024-09-25 | OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords. |
CVE-2024-40761 | Medium | 5.3 | 2024-09-25 | Inadequate Encryption Strength vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.3.5.
Using the MD5 value of a user's email to acce… |
CVE-2024-39928 | High | 7.5 | 2024-09-25 | In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons… |
CVE-2024-45394 | High | 8.8 | 2024-09-03 | Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypt… |
CVE-2021-38121 | High | 8.3 | 2024-08-28 | Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices. … |
CVE-2024-21787 | Medium | 6.4 | 2024-08-14 | Inadequate encryption strength for some BMRA software before version 22.08 may allow an authenticated user to potentially enable escalation of privilege via lo… |
CVE-2024-41681 | Medium | 6.7 | 2024-08-13 | A vulnerability has been identified in Location Intelligence family (All versions < V4.4). The web server of affected products is configured to support weak ci… |
CVE-2024-5800 | High | 7.5 | 2024-08-12 | Diffie-Hellman groups with insufficient strength are used in the SSL/TLS stack of B&R Automation Runtime versions before 6.0.2, allowing a network attacker to… |
CVE-2024-42163 | High | 8.3 | 2024-08-12 | Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to take over the account of any user by predicting th… |
CVE-2024-21881 | | | 2024-08-12 | Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects E… |
CVE-2024-40719 | Medium | 6.5 | 2024-08-02 | The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a remote attacker trick… |
CVE-2024-32758 | High | 7.5 | 2024-08-01 | Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange |
CVE-2024-37034 | Medium | 5.9 | 2024-07-26 | An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the Key-Value (KV) ser… |
CVE-2024-38867 | Medium | 5.9 | 2024-07-09 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.64), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All… |
CVE-2024-38277 | Medium | 5.4 | 2024-06-18 | A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two. |
CVE-2024-30119 | Low | 3.7 | 2024-06-14 | HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header. This could allow an attacker to intercept or manipulate data durin… |
CVE-2024-34113 | Medium | 5.5 | 2024-06-13 | ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass… |
CVE-2024-36823 | High | 7.5 | 2024-06-06 | The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information. |
CVE-2024-28974 | High | 7.6 | 2024-05-29 | Dell Data Protection Advisor, version(s) 19.9, contain(s) an Inadequate Encryption Strength vulnerability. A low privileged attacker with remote access could p… |
CVE-2024-23580 | Medium | 6.5 | 2024-05-28 | HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs). This could allow an attacker with access to the database to r… |
CVE-2024-23579 | Medium | 6.5 | 2024-05-28 | HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the database to recover… |
CVE-2023-37397 | Low | 3.6 | 2024-04-19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain or modify sensitive information due to improper encryption of certain data. IBM X-For… |