Skip to content
CVE Tracker

CWE-326

482 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 4 of them as exploited in the wild.

All 482 in the listAtom feed of new CVEsWhat CWE-326 is, at MITRE (opens in a new tab)
Published CVEs
482
Last 12 months
55
Critical
49
Known exploited
4

Critical 49High 177Medium 229Low 26Not scored 1

CVEs per yearBy the year they were published

  1. 20193
  2. 20191
  3. 202030
  4. 202017
  5. 202139
  6. 202142
  7. 202343
  8. 202549
  9. 202644
  10. 202635
  11. 202660
  12. 202637

Known exploitedNewest addition to KEV first

  • CVE-2017-11317

    Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote…

    Product not named

    ExploitedCritical9.8
  • CVE-2017-1000486

    Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

    Product not named

    ExploitedCritical9.8
  • CVE-2018-18325

    DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for…

    Product not named

    ExploitedHigh7.5
  • CVE-2018-15811

    DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

    Product not named

    ExploitedHigh7.5

Newest CVEs

  • CVE-2026-121109

    Inadequate encryption strength in SSL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via crafted…

    Google · Chrome

    Not scored
  • CVE-2026-63286

    Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro…

    Axis Communications AB · AXIS Camera Station Pro

    High7.1
  • CVE-2026-116054

    SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash

    SH3

    Low2.1
  • CVE-2026-114616

    Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)

    authlib · authlib

    High7.4
  • CVE-2026-105996

    Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token

    Unknown · Booking Package

    Medium4.8
  • CVE-2026-112029

    diem-project diem SHA1 PluginDmUser.class.php weak password hash

    diem-project · diem

    Low2.0
  • CVE-2026-112026

    light0011 cms UserModel.class.php sha1 weak password hash

    light0011 · cms

    Medium6.3
  • CVE-2026-35088

    Inadequate Encryption Strength in Slican telephone exchanges

    Slican · IPx

    High8.2
  • CVE-2026-83885

    Windows Virtualization-Based Security (VBS) Enclave Spoofing Vulnerability

    Microsoft · Windows 11 Version 24H2

    Medium5.6
  • CVE-2026-105193

    Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash

    Unknown · Booking Calendar

    Medium4.8

Vendors it comes up for most

  1. IBM56
  2. HCL Software9
  3. Apache Software Foundation8
  4. Siemens8
  5. Google7
  6. Dell6
  7. Microsoft6
  8. Cisco4
  9. Mozilla4
  10. Brocade3