Skip to content

CWE-649 · weakness in Cryptography

Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking

9 CVEs

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

  1. RSA BSAFE Micro Edition Suite versions prior to 4.1.6.3 (in 4.1.x) and prior to 4.4 (in 4.2.x and 4.3.x), are vulnerable to an Information Exposure Through an Error Message vulner…CVE-2019-3730Dell · CVSS 5.9 · 0.6% likely

    Dell

  2. It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.CVE-2010-3300Owasp · 0.4% likely

    Owasp

  3. SICK InspectorP61x and SICK InspectorP62x are vulnerable for firmware modificationCVE-2024-10772SICK AG · CVSS 8.8 · 0.3% likely

    SICK AG

  4. In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allo…CVE-2026-96414Octopus Deploy · CVSS 8.7 · 0.2% likely

    Octopus Deploy

  5. Weak encryption on Funambol's cloud serverCVE-2025-41351Funambol · CVSS 6 · 0.2% likely
  6. Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android…CVE-2024-36279FreeFrom K.K. · CVSS 5.3 · 0.1% likely
  7. fossasia open-event-server Mail Verification mail.py send_email_change_user_email reliance on obfuscation or encryption of security-relevant inputs without integrity checkingCVE-2025-5323fossasia · CVSS 3.7 · 0.1% likely
  8. Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flippingCVE-2026-95105danielberkompas · CVSS 8.2 · 0.1% likely
  9. ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent TokensCVE-2026-105208zitadel · CVSS 7.7 · 0.1% likely

    Zitadel

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.