cve.bz

OWASP A04:2025 Cryptographic Failures vulnerabilities, newest first, page 13

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A04:2025 at MITRE.

Its weaknesses: 32

CWE-261, CWE-296, CWE-319, CWE-320, CWE-321, CWE-322, CWE-323, CWE-324, CWE-325, CWE-326, CWE-327, CWE-328, CWE-329, CWE-330, CWE-331, CWE-332, CWE-334, CWE-335, CWE-336, CWE-337, CWE-338, CWE-340, CWE-342, CWE-347, CWE-523, CWE-757, CWE-759, CWE-760, CWE-780, CWE-916, CWE-1240, CWE-1241

  1. 7.5CVE-2026-68757EPSS 0.3%

    A user with access to a valid SAML response may impersonate another user under specific conditions.

  2. 9.1CVE-2025-59324EPSS 0.2%

    CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are skipped.

  3. 7.5CVE-2025-59322EPSS 0.5%

    CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted as plaintext.

  4. 7.5CVE-2025-59327EPSS 0.2%

    In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are skipped.

  5. 9.0CVE-2026-18691EPSS 0.4%

    An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, thi…

  6. 5.3CVE-2026-65777EPSS 0.4%

    Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network.

  7. 5.9CVE-2026-62757EPSS 0.3%

    Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network.

  8. 7.5CVE-2026-48386EPSS 1.0%

    ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of …

  9. 8.4CVE-2026-34635EPSS 0.2%

    is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write…

  10. 7.0CVE-2026-57263EPSS 0.1%

    A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allow an attacker who has obtained the project…

  11. 7.0CVE-2026-57262EPSS 0.1%

    A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the applicat…

  12. 8.1CVE-2026-15556EPSS 0.3%

    A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protec…

  13. 9.8CVE-2026-10579EPSS 0.4%

    A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lea…

  14. 5.9CVE-2026-66776EPSS 0.2%

    SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity che…

  15. 7.9CVE-2026-66763EPSS 0.2%

    SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these…

  16. 8.5CVE-2025-30239EPSS 0.2%

    In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. …

  17. 7.5CVE-2026-18611EPSS 0.6%

    A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB root/user passwords and MinIO access/secret keys, if they can access the MinIO …

  18. 8.6CVE-2026-10754EPSS 0.8%

    Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.

  19. 4.4CVE-2026-59112EPSS 0.1%

    Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This iss…

  20. 6.7CVE-2026-16742EPSS 0.06%

    systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user

  21. 7.7CVE-2026-66407EPSS 0.3%

    DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents ma…

  22. 7.1CVE-2026-58262EPSS 0.2%

    Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not corr…

  23. 9.0CVE-2026-71851EPSS 0.5%

    crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded fr…

  24. 8.8CVE-2026-54218EPSS 0.5%

    Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file sy…

  25. 6.5CVE-2026-49008EPSS 0.3%

    By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device.

  26. 5.3CVE-2026-49006EPSS 0.2%

    By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.

  27. 2.4CVE-2026-49005EPSS 0.2%

    The root password hash of the device can be obtained through unencrypted information in the firmware.

  28. 7.5CVE-2026-62918EPSS 0.5%

    Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.

  29. 9.8CVE-2026-62873EPSS 0.6%

    Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.

  30. 10.0CVE-2026-5430KEVEPSS 22%

    The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading …

  31. 7.2CVE-2026-18411EPSS 0.3%

    The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized command…

  32. 9.8CVE-2026-9205EPSS 0.3%

    IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

  33. 8.8CVE-2026-9201EPSS 0.4%

    IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional hardening mode that restricts execution t…

  34. 9.1CVE-2026-8470EPSS 0.1%

    IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deter…

  35. 6.5CVE-2026-20294EPSS 0.2%

    A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to insuffi…

  36. 9.1CVE-2026-7557EPSS 0.5%

    An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate an…

  37. 9.2CVE-2026-39923EPSS 0.4%

    Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordCon…

  38. 5.3CVE-2026-18531EPSS 0.4%

    IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret.

  39. 9.1CVE-2026-16443EPSS 0.3%

    A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usag…

  40. 6.5CVE-2026-71225EPSS 0.3%

    A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vecto…

  41. 2.3CVE-2026-17578EPSS 0.2%

    Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. …

  42. 9.1CVE-2026-14804EPSS 0.4%

    Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resource…

  43. 9.1CVE-2026-18754EPSS 0.4%

    The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communicat…

  44. 9.1CVE-2026-18753EPSS 0.4%

    The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communicat…

  45. 3.7CVE-2026-18569EPSS 0.2%

    A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an…

  46. 9.2CVE-2026-46713EPSS 0.3%

    Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted…

  47. 6.9CVE-2026-18654EPSS 0.5%

    Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positio…

  48. 9.8CVE-2026-38447EPSS 0.7%

    osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can …

  49. 5.7CVE-2025-15631EPSS 0.3%

    A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data …

  50. 6.9CVE-2025-15629EPSS 0.3%

    A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. …