CWE-326: Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- google chrome Inadequate encryption strength in SSL in Google Chrome prior to 157.0.8103.38 allowed a remote... No score
- axis communications ab camera station pro, camera station 5 +1 more Database backups are vulnerable to offline attacks. Backups created using a version prior to the... 7.1 High
- No product listed SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash 2.1 Low
- authlib Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) 7.4 High
- masaakitanaka booking package Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token 4.8 Medium
- diem-project diem diem-project diem SHA1 PluginDmUser.class.php weak password hash 2.0 Low
- light0011 cms light0011 cms UserModel.class.php sha1 weak password hash 6.3 Medium
- slican cct-1668, cxs-0424, ipx +1 more +3 more Inadequate Encryption Strength in Slican telephone exchanges 8.2 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +8 more +10 more Windows Virtualization-Based Security (VBS) Enclave Spoofing Vulnerability 5.6 Medium
- unknown booking calendar Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash 4.8 Medium
- No product listed YzmCMS MD5 system.func.php password weak password hash 6.3 Medium
- imprivata enterprise access management Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production 7.5 High
- stefano lissa newsletter Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key 4.8 Medium
- rabbitmq amqp091-go RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser 9.4 Critical
- aircheng-org iwebshop-5 aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash 6.3 Medium
- tribulant software newsletters Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key 4.8 Medium
- jahlives openssl encrypt openssl_encrypt before 1.4.9 Weak Cryptographic Parameters 8.7 High
- spring security, vmware spring security +1 more Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation 6.5 Medium
- google chrome Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to 152.0... 4.3 Medium
- jahlives openssl encrypt openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF 9.3 Critical
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +8 more +10 more Active Directory Security Feature Bypass Vulnerability 5.3 Medium
- ibm langflow oss, langflow +1 more Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling 8.8 High
- bouncycastle bouncy castle for java lts, bc-java, legion of the bouncy castle inc. bc-lts-java +2 more BKS keystore accepts legacy version with 16-bit integrity MAC key 7.1 High
- casfid servicios tecnológicos nfc wristbands Insufficient Encryption Level in CasfID Servicios Tecnológicos NFC Wristbands 6.8 Medium
- pronetiqs panduit intravue Inadequate Encryption Strength in Panduit IntraVUE by Pronetiqs 7.6 High
- hcl software aftermarket epc HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of... 9.1 Critical
- hclsoftware dfxserver, hcltech dfx server +1 more HCL DFXServer is affected by an Unencrypted Communication vulnerability. 6.3 Medium
- No product listed Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book... 7.5 High
- arcinfo pcvue Weak encryption mechanism for User directory 8.4 High
- authlib joserfc joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) 8.7 High
- uvnc ultravnc UltraVNC MS-Logon II uses 64-bit Diffie-Hellman and seeded libc rand() enabling credential interception 7.4 High
- cloud foundry bosh CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token... 7.1 High
- securly, securly chrome extension +1 more CVE-2026-8878 7.5 High
- jwt ruby-jwt `jwt` (Ruby gem) - empty-key HMAC bypass 9.1 Critical
-
github.com/slack-go/slackGo slack-go `SecretsVerifier` accepts empty signing secret without precondition 4.8 Medium - electerm electerm's encrypt method not safe enough 6.0 Medium
- meari com.meari.sdk Meari weak XOR obfuscation 7.5 High
- enchant97 note-mark Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery 10.0 Critical
- nearform fast-jwt fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass 9.1 Critical
- linux, linux kernel +1 more Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ 8.1 High
- elba elba5 ELBA5 5.8.0 Remote Code Execution via Database Access 9.3 Critical
- fortra goanywhere mft, goanywhere agents, goanywhere managed file transfer +2 more Encryption vulnerable to brute-force decryption in GoAnywhere MFT 5.8 Medium
- tp-link systems inc. archer c7 v5 and v5.8, tp-link archer c7 firmware +1 more Use of weak cryptographic key in TP-Link Archer C7 5.4 Medium
- google chrome Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read... 4.3 Medium
- orangehrm OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosure 2.1 Low
- wwbn avideo AVideo has an unauthenticated decrypt oracle leaking any ciphertext 7.5 High
- wwbn avideo AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin 7.4 High
- grafana tempo S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern) 7.5 High
- ibm qradar edr, security qradar edr +1 more IBM Security QRadar EDR Software has multiple vulnerabilities 5.9 Medium
- samrocketman jervis Jervis has a Salt for PBKDF2 derived from password 8.7 High
- Show olderLoading…