CWE-1240 · weakness in Cryptography
Use of a Cryptographic Primitive with a Risky Implementation
21 CVEs
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 21 is a mark on the map. Named now: 1 to 21, most at risk first.
- Windows Cryptographic Services Information Disclosure Vulnerability
- B&R products use insufficient communication encryption
- Soundness issue with Plonky2 look up tables
- `libparsec_crypto` does not check for weak order point of curve 25519
- Apache StreamPark: Uses the user’s password as the secret key
- Windows Key Guard Security Feature Bypass Vulnerability
- Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM
- Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.10 contains a use of a Cryptographic Primitive with a Risky Implementation vulnerability. A remote atta…
- FTP uses unsecure encryption mechanisms
- HCL Hive is affected by use of a cryptographic primitive with a risky implementation
- Windows Cryptographic Services Information Disclosure Vulnerability
- Multiple Vulnerabilities in IBM Concert Software
- HCL Hive is affected by use of a cryptographic primitive with a risky implementation
- Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`
- Elliptic Cryptanalysis vulnerability when `k` has leading zeros
- uTLS has a Chrome Parrot Fingerprint Vulnerability due to GREASE ECH Cipher Suite Mismatch
- RustCrypto: Signatures has timing side-channel in ML-DSA decomposition
- Function Abusement Vulnerability in ZTE ZXUniPOS NDS-LTE
- Dell Key Trust Platform, v3.0.6 and prior, contains Use of a Cryptographic Primitive with a Risky Implementation vulnerability. A local privileged attacker could potentially explo…
- Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss
- Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerability. A high privileged attacker could potentially exploit thi…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.