CWE-836

CVEs per yearBy the year they were published

1. 20171
2. 20211
3. 20221
4. 20235
5. 20254
6. 20266

Newest CVEs

• CVE-2026-63158

  Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies

  Omnispace · Agora Project

  Critical9.1
• CVE-2026-46488

  motionEye: Authentication possible via password hash

  motioneye-project · motioneye

  Critical9.1
• CVE-2026-44736

  OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects

  opf · openproject

  Medium6.5
• CVE-2026-9222

  Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication

  Shenzhen i365-Tech Co. Ltd. · Setracker2 Parental Control App (Android) package com.tgelec.setracker

  Critical9.2
• CVE-2026-40103

  Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds

  go-vikunja · vikunja

  Medium4.3
• CVE-2019-25552

  CEWE PHOTO SHOW 6.4.3 Denial of Service via Password Field

  Cewe-Photoworld · CEWE PHOTO SHOW

  High8.7
• CVE-2025-64471

  A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0…

  Fortinet · FortiWeb

  Medium4.4
• CVE-2025-62618

  ELOG file upload stored XSS

  ELOG · ELOG

  High8.6
• CVE-2025-52543

  Login to the application services using only the password hash

  Copeland LP · E3 Supervisory Control

  Medium5.3
• CVE-2025-48925

  The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication…

  TeleMessage · service

  Medium4.3

Vendors it comes up for most

1. Cewe-Photoworld1
2. Copeland LP1
3. Digi International1
4. ELOG1
5. Fortinet1
6. NEC Corporation1
7. Omnispace1
8. Rexroth1
9. SICK AG1
10. Shenzhen i365-Tech Co. Ltd.1