Skip to content
CVE Tracker

CWE-311

527 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

All 527 in the listAtom feed of new CVEsWhat CWE-311 is, at MITRE (opens in a new tab)
Published CVEs
527
Last 12 months
33
Critical
29
Known exploited
1

Critical 29High 274Medium 199Low 25Not scored 0

CVEs per yearBy the year they were published

  1. 20191
  2. 20192
  3. 202041
  4. 202126
  5. 202237
  6. 20222
  7. 202330
  8. 202451
  9. 202527
  10. 20252
  11. 202623
  12. 202639

Known exploitedNewest addition to KEV first

  • CVE-2026-34486

    Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

    Apache Software Foundation · Apache Tomcat

    ExploitedHigh7.5

Newest CVEs

  • CVE-2026-116198

    Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store

    grokability · snipe-it

    Medium5.3
  • CVE-2026-115247

    subhajitkhan online-clinic-management-system patientregistration.php missing encryption

    subhajitkhan · online-clinic-management-system

    Medium5.3
  • CVE-2026-43854

    A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices.

    Advantech · ADAM-3600

    Medium6.3
  • CVE-2026-111063

    AIOHTTP: Secure attribute not enforced for shared cookie

    aio-libs · aiohttp

    Medium6.3
  • CVE-2026-86375

    Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated attacker with local…

    Dell · Application Installer,

    Medium6.2
  • CVE-2026-105179

    SourceCodester Drug Recommendation System Password add_user.php missing encryption

    SourceCodester · Drug Recommendation System

    Medium5.1
  • CVE-2026-78860

    An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext

    Product not named

    High7.8
  • CVE-2026-92757

    Malformed connection string may disable field level encryption

    MongoDB Inc. · MongoDB Entity Framework Core Provider

    Medium6.8
  • CVE-2026-92756

    Combining encryption settings may disable encryption

    MongoDB Inc. · MongoDB Entity Framework Core Provider

    Medium6.8
  • CVE-2026-84676

    Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be…

    Jenkins Project · Jenkins Parameterized Remote Trigger Plugin

    Medium4.3

Vendors it comes up for most

  1. HackerOne144
  2. Jenkins Project50
  3. IBM33
  4. Cisco6
  5. Siemens6
  6. HCL Software5
  7. Apache Software Foundation4
  8. Dell4
  9. Siemens AG4
  10. Synology4