cve.bz

OWASP A04:2025 Cryptographic Failures vulnerabilities, newest first, page 4

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A04:2025 at MITRE.

Its weaknesses: 32

CWE-261, CWE-296, CWE-319, CWE-320, CWE-321, CWE-322, CWE-323, CWE-324, CWE-325, CWE-326, CWE-327, CWE-328, CWE-329, CWE-330, CWE-331, CWE-332, CWE-334, CWE-335, CWE-336, CWE-337, CWE-338, CWE-340, CWE-342, CWE-347, CWE-523, CWE-757, CWE-759, CWE-760, CWE-780, CWE-916, CWE-1240, CWE-1241

  1. 8.2CVE-2026-111347EPSS 0.5%

    go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /ba…

  2. 8.2CVE-2026-111330EPSS 0.2%

    JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through da…

  3. 7.8CVE-2026-105035EPSS 0.2%

    The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any d…

  4. 9.1CVE-2026-102946EPSS 0.1%

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures ar…

  5. 8.2CVE-2026-35088EPSS 0.1%

    Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication. This issue was fixed in IPx series ve…

  6. 9.1CVE-2026-108336EPSS 0.2%

    When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is lo…

  7. 6.0CVE-2026-110310EPSS 0.5%

    A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known B…

  8. 8.2CVE-2026-110765EPSS 0.2%

    FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment I…

  9. 7.0CVE-2026-100413EPSS 0.4%

    SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfs_s…

  10. 7.5CVE-2026-15102EPSS 0.1%

    ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services.

  11. 9.3CVE-2026-110612EPSS 1.0%

    vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupI…

  12. 4.6CVE-2026-73794EPSS 0.1%

    HPE NonStop MODULAR NSJ  contains a predictable seed vulnerability in Random Number Generation (PRNG)

  13. 6.9CVE-2026-107171EPSS 0.1%

    An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.

  14. 7.5CVE-2026-95633EPSS 0.3%

    CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain una…

  15. 7.5CVE-2026-95632EPSS 0.5%

    CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain una…

  16. 7.5CVE-2026-103297EPSS 0.5%

    CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain una…

  17. 7.5CVE-2026-103296EPSS 0.5%

    CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain una…

  18. 5.3CVE-2026-102502EPSS 0.4%

    CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain una…

  19. 8.7CVE-2026-101294EPSS 0.2%

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptograp…

  20. 9.1CVE-2026-63149EPSS 0.4%

    Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server …

  21. 7.8CVE-2026-97799EPSS 0.3%

    Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.

  22. 8.8CVE-2026-96957EPSS 0.5%

    Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

  23. 9.1CVE-2026-96252EPSS 0.6%

    Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

  24. 7.5CVE-2026-87696EPSS 0.4%

    Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

  25. 9.0CVE-2026-85818EPSS 0.4%

    Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.

  26. 5.6CVE-2026-83885EPSS 0.2%

    Inadequate encryption strength in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally.

  27. 5.5CVE-2026-83798EPSS 0.2%

    Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally.

  28. 5.5CVE-2026-70071EPSS 0.3%

    Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perform tampering locally.

  29. 7.8CVE-2026-69650EPSS 0.3%

    Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.

  30. 6.8CVE-2026-59116EPSS 0.4%

    Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over a network.

  31. 6.3CVE-2026-110214EPSS 0.5%

    Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can comput…

  32. 8.1CVE-2026-102866EPSS 0.7%

    Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

  33. 5.3CVE-2026-106172EPSS 0.2%

    A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0…

  34. 8.2CVE-2026-110104EPSS 0.3%

    Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password. Attackers who obtain the …

  35. 8.6CVE-2026-65198EPSS 0.2%

    Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, a…

  36. 3.1CVE-2026-65197EPSS 0.10%

    H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` acti…

  37. 9.8CVE-2026-53709EPSS 0.6%

    MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() c…

  38. 2.1CVE-2026-11730EPSS 0.2%

    Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated admini…

  39. 6.0CVE-2026-109952EPSS 0.3%

    The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiation_response(), allowing a security protocol downgrade. A malicious serv…

  40. 7.1CVE-2026-65104EPSS 0.1%

    NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. A successful exploit of this vulnerability might lead to data tampering and…

  41. 8.6CVE-2026-108971EPSS 0.2%

    A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improp…

  42. 5.1CVE-2026-92832EPSS 0.07%

    IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information.

  43. 8.2CVE-2026-109424EPSS 0.2%

    NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB ke…

  44. 7.5CVE-2026-85975EPSS 0.2%

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through a…

  45. 7.4CVE-2026-85973EPSS 0.1%

    Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned attacker could intercept or modify information transmitted through an affected connection.

  46. 7.5CVE-2026-85963EPSS 0.4%

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to interna…

  47. 7.5CVE-2026-85962EPSS 0.3%

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker coul…

  48. 4.0CVE-2026-93694EPSS 0.07%

    In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService…

  49. 7.5CVE-2026-103902EPSS 0.1%

    Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures that are …

  50. 6.9CVE-2026-108798EPSS 0.3%

    A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version…