CWE-328: Use of Weak Hash
The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
A kind of CWE-327 Use of a Broken or Risky Cryptographic Algorithm.
From the CWE List. © The MITRE Corporation.
Newest
- nvidia megatron-lm NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker... 7.1 High
- apache cxf Apache CXF: Authentication bypass via weak cache keys for validated STS tokens 9.1 Critical
- dalibo postgresql anonymizer PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink 4.3 Medium
- No product listed An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary... 9.8 Critical
- No product listed wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash 2.3 Low
- papermerge dms Weak password hashing in R-SOFT DMS 8.2 High
- langchain-ai langgraph langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash 2.3 Low
- exo-explore exo exo-explore exo Vision Feature Cache vision.py _image_cache_key weak hash 6.3 Medium
- forceinjection ai-fundermentals ForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hash 2.3 Low
- bmc control-m/enterprise manager Weak password hash protection in Control-M/Entreprise Manager 5.6 Medium
- dalibo postgresql anonymizer PostgreSQL Anonymizer: Unrestricted function can leak the secret salt 4.3 Medium
- redeight cms Weak hashing algorithm in Redeight CMS 5.9 Medium
- simstudioai sim SimStudioAI sim Password Protection deployment.ts weak hash 6.3 Medium
- skypilot-org skypilot skypilot-org skypilot User ID server.py username.encode weak hash 6.3 Medium
- motioneye-project motioneye motionEye: Authentication possible via password hash 9.1 Critical
- angular Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning 8.8 High
- thorsten phpmyfaq phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing 2.7 Low
- yoanbernabeu grepai yoanbernabeu grepai Postgres Embedding Cache chunker.go PostgresStore.LookupByContentHash weak hash 2.0 Low
- yoanbernabeu grepai yoanbernabeu grepai Qdrant Backend chunker.go weak hash 2.3 Low
- thedotmack claude-mem thedotmack claude-mem Observation Content Hash store.ts computeObservationContentHash weak hash 2.0 Low
- onnx onnx-mlir onnx onnx-mlir Placeholder Node Cache backend.py generate_hash_key weak hash 2.0 Low
- milvus milvus-io milvus Grantee ID Hash kv_catalog.go weak hash 2.0 Low
-
lmcachePyPI LMCache KV Cache utils.py hex_hash_to_int16 weak hash 2.0 Low - zilliztech gptcache zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash 2.0 Low
- snowflake streamlit Streamlit Palette hashing.py weak hash 2.0 Low
- lfprojects mlflow MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash 2.0 Low
- modelscope ms-swift modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash 2.0 Low
- paddlepaddle fastdeploy PaddlePaddle FastDeploy MultimodalHasher hasher.py hash_features weak hash 2.0 Low
- No product listed GNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password,... 9.8 Critical
- gradio-app gradio gradio-app gradio Audio Cache Key save_audio_to_cache weak hash 2.0 Low
-
mlrunPyPI mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash 2.0 Low - 1panel-dev maxkb MaxKB: Unsalted MD5 Password Hashing 6.9 Medium
- opensourcepos open source point of sale opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash 6.3 Medium
- paiement ecommerce systempay Ecommerce Systempay 1.0 Production Key Brute Force 9.3 Critical
- sandboxie-plus sandboxie Sandboxie-Plus EditPassword hash entropy reduced from 160 bits to 80 bits due to incorrect nibble extraction 2.0 Low
- chatchat-space langchain-chatchat chatchat-space Langchain-Chatchat Vision Chat Paste Image dialogue.py PIL.Image.tobytes weak hash 2.1 Low
- code-projects chat system code-projects Chat System MD5 Hash update_user.php weak hash 6.3 Medium
-
p3-symmetriccrates.io Plonky3: The sponge construction used to get a hash function from a cryptographic permutation is not collision resistant for inputs of different lengths 2.9 Low - jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +24 more +26 more jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed 7.5 High
- nodejs node, node.js +1 more A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric... 5.9 Medium
- stellar rs-soroban-poseidon Poseidon V1 variable-length input collision via implicit zero-padding 8.7 High
- mbs ubr-01 mk ii, ubr-02, ubr-lon +1 more +3 more Secret leak with wwwdnload.cgi 6.2 Medium
- flowise Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing 5.6 Medium
-
@keep-network/tbtc-v2npm @keep-network/tbtc-v2 revealing P2PKH deposit with a wrapped P2SH script 7.5 High - shenzhen hongyavision technology co., ltd. (sodola networks) sodola sl902-swtgw124as, sodola-network sl902-swtgw124as firmware +1 more SODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token Generation 6.9 Medium
- openclaw OpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox Configuration 8.7 High
- tenda ax9, ax9 firmware +1 more Tenda AX9 httpd image_check weak hash 6.3 Medium
- vercel next.js Next.js: Cache poisoning via collisions in React Server Component cache-busting 3.7 Low
- tomofun furbo 360, furbo mini, furbo 360 dog camera firmware +1 more +3 more Tomofun Furbo 360/Furbo Mini Password shadow weak hash 1.0 Low
- dragonflyoss dragonfly Dragonfly has weak integrity checks for downloaded files 5.5 Medium
- Show olderLoading…