CVE-2026-81704 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256… |
CVE-2026-81689 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys acr… |
CVE-2026-80211 | Medium | 5.9 | 2026-08-27 | FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and upd… |
CVE-2026-53762 | Medium | 6.2 | 2026-08-21 | VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPT_BACKEND… |
CVE-2026-75112 | | | 2026-08-19 | A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implemen… |
CVE-2026-74871 | Medium | 6.2 | 2026-08-17 | openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation… |
CVE-2026-49005 | Low | 2.4 | 2026-08-07 | The root password hash of the device can be obtained through unencrypted information in the firmware. |
CVE-2026-57310 | | | 2026-07-20 | Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode use… |
CVE-2026-5040 | Medium | 6.7 | 2026-07-14 | TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or pr… |
CVE-2026-40522 | High | 7.1 | 2026-06-29 | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitr… |
CVE-2026-55069 | High | 8.7 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kest… |
CVE-2026-56272 | Medium | 4.1 | 2026-06-24 | Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers… |
CVE-2026-9641 | Medium | 5.3 | 2026-06-12 | Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations.
The default algorithm is HMAC-SHA1, which should only… |
CVE-2026-25861 | Medium | 5.9 | 2026-06-02 | QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by e… |
CVE-2026-44611 | Medium | 5.4 | 2026-05-29 | Danelec MacGregor Voyage Data Recorder
passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks. |
CVE-2026-45787 | Critical | 9.1 | 2026-05-28 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, const… |
CVE-2026-45027 | Medium | 5.9 | 2026-05-27 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, when a user logs in, html/login.php hashes the submitted password using PHP's h… |
CVE-2026-30789 | Critical | 9.8 | 2026-03-05 | Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts vulnerability in rustdesk-client RustDes… |
CVE-2026-30785 | Medium | 5.5 | 2026-03-05 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerab… |
CVE-2025-67168 | Medium | 5.3 | 2025-12-17 | RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords. |
CVE-2025-13532 | Medium | 6.2 | 2025-12-16 | Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms… |
CVE-2025-41692 | Medium | 6.8 | 2025-12-09 | A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak passwo… |
CVE-2025-46413 | Medium | 4.3 | 2025-11-07 | Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. When WPS is enabled, PIN code and/or Wi-… |
CVE-2025-7789 | Low | 3.7 | 2025-07-18 | A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/j… |
CVE-2025-3937 | High | 7.7 | 2025-05-22 | Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Secur… |
CVE-2025-24340 | Medium | 6.5 | 2025-04-30 | A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintext passwords of ot… |
CVE-2025-27552 | Medium | 4.0 | 2025-03-26 | DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.
This vulnerability is associated with progr… |
CVE-2025-27551 | Medium | 4.0 | 2025-03-26 | DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.
This vulnerability is associated with progr… |
CVE-2025-26486 | Medium | 6.0 | 2025-03-19 | Broken or Risky Cryptographic Algorithm, Use of Password Hash
With Insufficient Computational Effort, Use of Weak Hash, Use of a
One-Way Hash with a Predicta… |
CVE-2025-2349 | Low | 3.1 | 2025-03-16 | A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2025-2265 | High | 7.8 | 2025-03-13 | The password of a web user in "Sante PACS Server.exe" is zero-padded to 0x2000 bytes, SHA1-hashed, base64-encoded, and stored in the USER table in the SQLite d… |
CVE-2023-33838 | Medium | 4.4 | 2025-01-29 | IBM Security Verify Governance 10.0.2 Identity Manager
uses a one-way cryptographic hash against an input that should not be reversible, such as a password… |
CVE-2024-5743 | Critical | 9.8 | 2025-01-13 | An attacker could exploit the 'Use of Password Hash With Insufficient Computational Effort' vulnerability in EveHome Eve Play to execute arbitrary code.
This… |
CVE-2024-55057 | Medium | 5.4 | 2024-12-17 | Phpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to user accounts. |
CVE-2024-7701 | High | 7.5 | 2024-12-15 | Use of Password Hash With Insufficient Computational Effort vulnerability in percona percona-toolkit allows Encryption Brute Forcing.This issue affects percona… |
CVE-2024-23091 | High | 7.5 | 2024-07-30 | Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values. |
CVE-2024-24553 | High | 7.5 | 2024-06-24 | Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attacks due to the inh… |
CVE-2024-3183 | High | 8.1 | 2024-06-12 | A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session… |
CVE-2024-21754 | Low | 1.8 | 2024-06-11 | A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all vers… |
CVE-2024-31464 | Medium | 6.8 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.19, 15.5.4, and 15.9-rc-1, it is possible to access the has… |
CVE-2024-29886 | Medium | 5.3 | 2024-03-27 | Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm that made it suscept… |
CVE-2024-2365 | Low | 1.6 | 2024-03-11 | A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io… |
CVE-2024-25607 | High | 8.1 | 2024-02-20 | The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before… |
CVE-2022-3010 | High | 7.5 | 2024-01-02 | The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calcula… |
CVE-2023-5846 | High | 8.3 | 2023-11-02 |
Franklin Fueling System TS-550 versions prior to 1.9.23.8960 are vulnerable to attackers decoding admin credentials, resulting in unauthenticated access to th… |
CVE-2023-46233 | Critical | 9.1 | 2023-10-25 | crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at… |
CVE-2023-46133 | Critical | 9.1 | 2023-10-25 | CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally… |
CVE-2022-47557 | Medium | 6.1 | 2023-09-19 | Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device is located to decrypt the credentials of privileg… |
CVE-2023-4986 | Low | 2.5 | 2023-09-15 | A vulnerability classified as problematic was found in Supcon InPlant SCADA up to 20230901. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2023-41646 | Medium | 5.3 | 2023-09-07 | Buttercup v2.20.3 allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/ |
CVE-2023-31412 | High | 7.5 | 2023-08-24 | The LMS5xx uses weak hash generation methods, resulting in the creation of insecure hashs. If an attacker manages to retrieve the hash, it could lead to collis… |
CVE-2023-34433 | High | 7.5 | 2023-07-07 |
PiiGAB M-Bus stores passwords using a weak hash algorithm.
|
CVE-2023-33243 | High | 8.1 | 2023-06-15 | RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of… |
CVE-2023-27580 | High | 7.5 | 2023-03-13 | CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage… |
CVE-2023-0567 | High | 7.7 | 2023-03-01 | In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such in… |
CVE-2022-26115 | Medium | 5.9 | 2023-02-16 | A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the pas… |
CVE-2022-40258 | Medium | 5.3 | 2023-01-31 | AMI Megarac Weak password hashes for
Redfish & API |
CVE-2022-47732 | High | 7.5 | 2023-01-20 | In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing… |
CVE-2020-12069 | High | 7.8 | 2022-12-26 | In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords… |
CVE-2022-40295 | Medium | 4.9 | 2022-10-31 | The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the com… |
CVE-2022-37164 | Critical | 9.8 | 2022-09-08 | Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Ad… |
CVE-2022-37163 | Critical | 9.8 | 2022-09-08 | Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force a… |
CVE-2022-36071 | High | 8.3 | 2022-09-02 | SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time… |
CVE-2022-29731 | Medium | 4.3 | 2022-06-02 | An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users. |
CVE-2021-32997 | High | 8.2 | 2022-05-25 | The affected Baker Hughes Bentley Nevada products (3500 System 1 6.x, Part No. 3060/00 versions 6.98 and prior, 3500 System 1, Part No. 3071/xx & 3072/xx versi… |
CVE-2020-16231 | High | 7.2 | 2022-05-19 | The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers… |
CVE-2022-24041 | Medium | 6.5 | 2022-05-10 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2021-26113 | Medium | 6.2 | 2022-04-06 | A use of a one-way hash with a predictable salt vulnerability [CWE-760] in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of… |
CVE-2022-1235 | High | 8.2 | 2022-04-05 | Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96. |
CVE-2022-23348 | Medium | 5.3 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes. |
CVE-2022-0022 | Medium | 4.1 | 2022-03-09 | Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not create… |
CVE-2021-43989 | High | 7.5 | 2021-12-23 | mySCADA myPRO Versions 8.20.0 and prior stores passwords using MD5, which may allow an attacker to crack the previously retrieved password hashes. |
CVE-2021-38979 | High | 7.5 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password… |
CVE-2021-39182 | High | 7.5 | 2021-11-08 | EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who ar… |
CVE-2021-36767 | Critical | 9.8 | 2021-10-08 | In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection inef… |
CVE-2021-38400 | Medium | 6.9 | 2021-10-04 | An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted USB to extract the… |
CVE-2021-38314 | Medium | 5.3 | 2021-09-02 | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `incl… |
CVE-2021-33003 | Medium | 5.5 | 2021-08-30 | Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithm. |
CVE-2021-37551 | Medium | 5.3 | 2021-08-06 | In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256. |
CVE-2021-32596 | Medium | 6.0 | 2021-08-04 | A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 through 6.04 may allow an attacker already i… |
CVE-2021-22774 | High | 7.5 | 2021-07-21 | A CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (E… |
CVE-2021-32519 | Critical | 9.8 | 2021-07-07 | Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-tex… |
CVE-2020-25754 | High | 7.5 | 2021-06-16 | An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authenti… |
CVE-2021-22741 | Medium | 6.7 | 2021-05-26 | Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 2019 (all versions)… |
CVE-2021-33563 | High | 7.5 | 2021-05-24 | Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brut… |
CVE-2019-20466 | High | 7.8 | 2021-04-02 | An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. A local attacker with the "default" account is capable of reading… |
CVE-2020-14516 | Critical | 10.0 | 2021-03-18 | In Rockwell Automation FactoryTalk Services Platform Versions 6.10.00 and 6.11.00, there is an issue with the implementation of the SHA-256 hashing algorithm w… |
CVE-2020-28873 | High | 7.5 | 2021-03-17 | Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sen… |
CVE-2020-10538 | Medium | 5.5 | 2021-02-05 | An issue was discovered in Epikur before 20.1.1. It stores the secret passwords of the users as MD5 hashes in the database. MD5 can be brute-forced efficiently… |
CVE-2020-6780 | Medium | 4.4 | 2021-01-26 | Use of Password Hash With Insufficient Computational Effort in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2… |
CVE-2021-21253 | Medium | 5.8 | 2021-01-21 | OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerabl… |
CVE-2020-14389 | High | 8.1 | 2020-11-17 | It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing a… |
CVE-2020-27693 | Medium | 4.4 | 2020-11-09 | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdated. |
CVE-2019-9080 | High | 7.5 | 2020-10-20 | DomainMOD before 4.14.0 uses MD5 without a salt for password storage. |
CVE-2020-14512 | High | 8.1 | 2020-08-25 | GateManager versions prior to 9.2c, The affected product uses a weak hash type, which may allow an attacker to view user passwords. |
CVE-2020-10040 | Medium | 5.5 | 2020-07-14 | A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attacker with local acces… |
CVE-2017-18917 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification token… |
CVE-2019-20575 | Medium | 5.4 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. The WPA3 handshake feature allows a downgrade or dictionary attack. The Samsung ID is S… |
CVE-2014-2560 | High | 7.5 | 2020-02-12 | The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers t… |
CVE-2009-5139 | High | 7.5 | 2020-02-12 | The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for… |