Missing Cryptographic Step

Every one of the 63 is a mark on the map. Named now: 1 to 26, most at risk first.

1. A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_S…CVE-2021-22946Haxx · CVSS 7.5 · 4.5% likely

   Haxx1 bounty report

2. Potential Remote Code Execution in TYPO3 with mediace extensionCVE-2020-15086FriendsOfTYPO3 · CVSS 9.8 · 3.6% likely
3. Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window si…CVE-2021-33560Gnupg · CVSS 7.5 · 2.4% likely

   Gnupg

4. Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMSCVE-2020-15098TYPO3 · CVSS 8.8 · 2.2% likely

   Typo3

5. RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulner…CVE-2019-3738Dell · CVSS 6.5 · 1.7% likely

   Dell

6. nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.CVE-2016-9574Mozilla · CVSS 5.9 · 1.4% likely

   Mozilla

7. Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be…CVE-2022-30115Haxx · 1.4% likely

   Haxx5 bounty reports

8. In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of…CVE-2017-2600Jenkins · CVSS 4.3 · 1.0% likely

   Jenkins

9. Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (S…CVE-2017-2598Jenkins · CVSS 4.3 · 1.0% likely

   Jenkins

10. Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362).CVE-2017-2603Jenkins · CVSS 2.6 · 1.0% likely

    Jenkins

11. Cryptographic issues in Python oicCVE-2020-26244OpenIDC · CVSS 6.8 · 0.8% likely

    OpenIDC

12. Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchangeCVE-2018-5383Apple · CVSS 8 · 0.8% likely

    Apple

13. AES-OCB IV Ignored on EVP_Cipher() PathCVE-2026-45445OpenSSL · CVSS 7.5 · 0.7% likely

    OpenSSL

14. Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keysCVE-2023-28998nextcloud · CVSS 6.7 · 0.7% likely

    Nextcloud

15. Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE foldersCVE-2023-28999nextcloud · CVSS 6.9 · 0.7% likely

    Nextcloud

16. Windows Kerberos Information Disclosure VulnerabilityCVE-2024-43547Microsoft · CVSS 6.5 · 0.7% likely

    Microsoft

17. Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access.CVE-2023-39199Zoom Video Communications, Inc. · CVSS 4.9 · 0.6% likely

    Zoom Video Communications, Inc.

18. Windows Kerberos Elevation of Privilege VulnerabilityCVE-2025-60704Microsoft · CVSS 7.5 · 0.6% likely

    Microsoft

19. FFC-DH Peer Validation Uses Attacker-Supplied qCVE-2026-42770OpenSSL · CVSS 3.7 · 0.5% likely

    OpenSSL

20. IBM Db2 Genius Hub Missing Cryptographic StepCVE-2026-109839IBM · CVSS 3.1 · 0.5% likely

    IBM

21. Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IPsec IKEv2 VPN Information Disclosure VulnerabilityCVE-2022-20742Cisco · CVSS 7.4 · 0.5% likely

    Cisco

22. Missing Cryptographic Step in star7th/showdocCVE-2021-3680star7th · CVSS 5.3 · 0.5% likely

    Star7th

23. Cisco Touch 10 Device Insufficient Identity Verification VulnerabilityCVE-2022-20793Cisco · CVSS 6.8 · 0.4% likely

    Cisco

24. Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modesCVE-2026-45446OpenSSL · CVSS 4.8 · 0.4% likely

    OpenSSL

25. Insecure EBICS messages encryption implementation in ebics-java/ebics-java-client could allow an adjacent attacker to decrypt EBICS payloadsCVE-2022-1279ebics-java · CVSS 6.5 · 0.4% likely
26. Missing Cryptographic Step in cassprojectCVE-2022-29229cassproject · CVSS 6.3 · 0.4% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.