CWE-328 · 63 records

Use of Weak Hash

CVEs in this class

63 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2025-27595No exploit	Weak hashing alghrythmsick ag · sick dl100-2xxxxxxx · CWE-328 Pre-auth	Critical9.8	—	0.5%	Mar 14, 2025
39Monitor	CVE-2025-41652No exploit	Weidmueller: Authentication Bypass Vulnerability in Industrial Ethernet Switchesweidmueller · ie-sw-vl05m-5tx · CWE-328 Pre-auth Auth bypass	Critical9.8	—	0.4%	May 27, 2025
39Monitor	CVE-2026-51996No exploit	An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getSCWE-328 pre-auth RCE	Critical9.8	—	0.4%	Sep 24, 2026
39Monitor	CVE-2022-45141No exploit	Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assusamba · samba · CWE-328 Pre-auth	Critical9.8	—	0.4%	Mar 6, 2023
39Monitor	CVE-2026-36182No exploit	GNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password, possibly allowing attackers to obtain rootCWE-328 Pre-auth	Critical9.8	—	0.3%	Jun 4, 2026
38Monitor	CVE-2024-54143No exploit	openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injectionopenwrt · asu · CWE-328 pre-auth RCE Command injection	Critical9.3	—	1.8%	Dec 6, 2024
37Monitor	CVE-2020-37168No exploit	Ecommerce Systempay 1.0 Production Key Brute Forcepaiement · ecommerce systempay · CWE-328 Pre-auth	Critical9.3	—	0.2%	May 13, 2026
36Monitor	CVE-2023-46233No exploit	crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standardcrypto-js project · crypto-js · CWE-328 Pre-auth	Critical9.1	—	0.6%	Oct 25, 2023
36Monitor	CVE-2023-46133No exploit	crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standardentronad · cryptoes · CWE-328 Pre-auth	Critical9.1	—	0.4%	Oct 25, 2023
36Monitor	CVE-2026-97468No exploit	Apache CXF: Authentication bypass via weak cache keys for validated STS tokensapache software foundation · apache cxf · CWE-328 Pre-auth Auth bypass	Critical9.1	—	0.1%	Oct 9, 2026
35Monitor	CVE-2024-48847No exploit	MD5 bypass operationabb · aspect-ent-2 firmware · CWE-328 Pre-auth	High8.8	—	0.2%	Dec 5, 2024
35Monitor	CVE-2026-54266No exploit	Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoningangular · angular · CWE-328 Pre-auth	High8.8	—	0.1%	Jun 22, 2026
35Monitor	CVE-2023-43635No exploit	Vault Key Sealed With SHA1 PCRslinuxfoundation · edge virtualization engine · CWE-328	High8.8	—	0.1%	Sep 20, 2023
35Monitor	CVE-2023-43630No exploit	Config Partition Not Measured From 2 Frontslinuxfoundation · edge virtualization engine · CWE-328	High8.8	—	0.1%	Sep 20, 2023
35Monitor	GHSA-5jvg-8j6f-vpmcNo exploit	Duplicate Advisory: EVE Doesn't Measure Config Partition From 2 FrontsGo · github.com/lf-edge/eve · CWE-328	High8.8	—	—	Sep 20, 2023
34Monitor	CVE-2024-48924No exploit	MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflowmessagepack-csharp · messagepack-csharp · CWE-328 Pre-auth Deserialization	High8.7	—	0.3%	Oct 17, 2024
34Monitor	CVE-2026-32129No exploit	Poseidon V1 variable-length input collision via implicit zero-paddingstellar · rs-soroban-poseidon · CWE-328 Pre-auth	High8.7	—	0.3%	Mar 12, 2026
32Monitor	CVE-2026-41879No exploit	Weak password hashing in R-SOFT DMSr-soft serwis · dms · CWE-328 Pre-auth	High8.2	—	0.2%	Jul 10, 2026
31Monitor	CVE-2019-13539No exploit	Medtronic Valleylab FT10 and FX8 Reversible One-way Hashmedtronic · valleylab exchange client · CWE-328	High7.8	—	0.2%	Nov 8, 2019
30Monitor	CVE-2023-2900No exploit	NFine Rapid Development Platform CheckLogin weak hashnfine rapid development platform project · nfine rapid development platform · CWE-328 Pre-auth	High7.5	—	0.6%	May 25, 2023
30Monitor	CVE-2026-40164No exploit	jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seedjqlang · jq · CWE-328 Pre-auth Denial of service	High7.5	—	0.5%	Apr 13, 2026
30Monitor	CVE-2025-47276No exploit	Actualizer Uses OpenSSL's "-passwd" Function Which Uses SHA512 Under The Hood Instead of Proper Password Hasher like Yescript/Argon2ichewkeanho · actualizer · CWE-328 Pre-auth	High7.5	—	0.3%	May 13, 2025
30Monitor	CVE-2025-49197No exploit	Deprecated TLS version supportedsick · media server · CWE-328 Pre-auth	High7.5	—	0.2%	Jun 12, 2025
30Monitor	CVE-2024-38341No exploit	IBM Sterling Secure Proxy information disclosureibm · sterling secure proxy · CWE-328 Pre-auth	High7.5	—	0.2%	May 28, 2025
30Monitor	CVE-2024-47182No exploit	Dozzle uses unsafe hash for passwordsamirraminfar · dozzle · CWE-328 Pre-auth	High7.5	—	0.2%	Sep 27, 2024

CVE-2025-27595
39Monitor
Weak hashing alghrythm
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
sick ag · sick dl100-2xxxxxxxMar 14, 2025
CVE-2025-41652
39Monitor
Weidmueller: Authentication Bypass Vulnerability in Industrial Ethernet Switches
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
weidmueller · ie-sw-vl05m-5txMay 27, 2025
CVE-2026-51996
39Monitor
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getS
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 24, 2026
CVE-2022-45141
39Monitor
Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assu
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
samba · sambaMar 6, 2023
CVE-2026-36182
39Monitor
GNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password, possibly allowing attackers to obtain root
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
Jun 4, 2026
CVE-2024-54143
38Monitor
openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injection
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
openwrt · asuDec 6, 2024
CVE-2020-37168
37Monitor
Ecommerce Systempay 1.0 Production Key Brute Force
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
paiement · ecommerce systempayMay 13, 2026
CVE-2023-46233
36Monitor
crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
crypto-js project · crypto-jsOct 25, 2023
CVE-2023-46133
36Monitor
crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
entronad · cryptoesOct 25, 2023
CVE-2026-97468
36Monitor
Apache CXF: Authentication bypass via weak cache keys for validated STS tokens
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache cxfOct 9, 2026
CVE-2024-48847
35Monitor
MD5 bypass operation
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
abb · aspect-ent-2 firmwareDec 5, 2024
CVE-2026-54266
35Monitor
Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
angular · angularJun 22, 2026
CVE-2023-43635
35Monitor
Vault Key Sealed With SHA1 PCRs
HighCVSS 8.8No exploitEPSS 0%
linuxfoundation · edge virtualization engineSep 20, 2023
CVE-2023-43630
35Monitor
Config Partition Not Measured From 2 Fronts
HighCVSS 8.8No exploitEPSS 0%
linuxfoundation · edge virtualization engineSep 20, 2023
GHSA-5jvg-8j6f-vpmc
35Monitor
Duplicate Advisory: EVE Doesn't Measure Config Partition From 2 Fronts
HighCVSS 8.8No exploit
Go · github.com/lf-edge/eveSep 20, 2023
CVE-2024-48924
34Monitor
MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Deserialization
messagepack-csharp · messagepack-csharpOct 17, 2024
CVE-2026-32129
34Monitor
Poseidon V1 variable-length input collision via implicit zero-padding
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
stellar · rs-soroban-poseidonMar 12, 2026
CVE-2026-41879
32Monitor
Weak password hashing in R-SOFT DMS
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
r-soft serwis · dmsJul 10, 2026
CVE-2019-13539
31Monitor
Medtronic Valleylab FT10 and FX8 Reversible One-way Hash
HighCVSS 7.8No exploitEPSS 0%
medtronic · valleylab exchange clientNov 8, 2019
CVE-2023-2900
30Monitor
NFine Rapid Development Platform CheckLogin weak hash
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
nfine rapid development platform project · nfine rapid development platformMay 25, 2023
CVE-2026-40164
30Monitor
jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
jqlang · jqApr 13, 2026
CVE-2025-47276
30Monitor
Actualizer Uses OpenSSL's "-passwd" Function Which Uses SHA512 Under The Hood Instead of Proper Password Hasher like Yescript/Argon2i
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
chewkeanho · actualizerMay 13, 2025
CVE-2025-49197
30Monitor
Deprecated TLS version supported
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
sick · media serverJun 12, 2025
CVE-2024-38341
30Monitor
IBM Sterling Secure Proxy information disclosure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
ibm · sterling secure proxyMay 28, 2025
CVE-2024-47182
30Monitor
Dozzle uses unsafe hash for passwords
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
amirraminfar · dozzleSep 27, 2024

All vulnerability classes