CWE-321 in Cryptography
- CVEs
- 436
- Exploited
- 2
- Public check
- 4
- Likely
- 3
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2023-21705Microsoft SQL Server Remote Code Execution Vulnerability | Microsoft · Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE) | Possible | 8.8 | 1.1% | 2023-02-14 |
| CVE-2024-5722Logsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution Vulnerability | Logsign · Unified SecOps Platform | Possible | 8.8 | 1.1% | 2024-11-22 |
| CVE-2026-75431PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code. | – | Possible | 9.1 | 1.1% | 2026-09-04 |
| CVE-2021-27389A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key is shipped with the product without adeq… | Siemens · Opcenter Quality | Possible | – | 1.1% | 2021-04-22 |
| CVE-2020-7846Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads to a file download and execution via acce… | Cnesty · Helpcom | Possible | 8.0 | 1.1% | 2021-02-24 |
| CVE-2024-33891Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded k… | Delinea · Secret Server | Possible | 8.8 | 1.0% | 2024-04-28 |
| CVE-2021-32520QSAN Storage Manager - Use of Hard-coded Cryptographic Key | QSAN · Storage Manager | Possible | 9.8 | 1.0% | 2021-07-07 |
| CVE-2026-5426KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value | Digital Knowledge · KnowledgeDeliver | Possible | 9.1 | 1.0% | 2026-04-16 |
| CVE-2026-110612vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil | wwwlike · vlife | Unlikely | 9.8 | 1.0% | 2026-10-14 |
| CVE-2023-37936A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.… | Fortinet · FortiSwitch | Unlikely | 9.6 | 1.0% | 2025-01-14 |
| CVE-2022-34425Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vulnerability, leading… | Dell · Enterprise SONiC OS | Unlikely | 7.5 | 0.9% | 2022-10-10 |
| CVE-2021-0266cSRX: Use of Hard-coded Cryptographic Keys allows an attacker to take control of the device through device management services. | Juniper Networks · Junos OS | Unlikely | 8.1 | 0.9% | 2021-04-22 |
| CVE-2025-30206Dpanel's hard-coded JWT secret leads to remote code execution | donknap · dpanel | Unlikely | 9.8 | 0.9% | 2025-04-15 |
| CVE-2022-21199An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man-in-the-middle attack can lead to a dis… | Reolink · Rlc-410w Firmware | Unlikely | 7.5 | 0.9% | 2022-01-28 |
| CVE-2023-27583Panindex uses hard coded cyptographic key | px-org · PanIndex | Unlikely | 9.8 | 0.9% | 2023-03-13 |
| CVE-2024-1631agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` | Internet Computer · agent-js | Unlikely | 9.1 | 0.9% | 2024-02-21 |
| CVE-2020-25193GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key | GE · Reason RT43X Clocks | Unlikely | 5.3 | 0.9% | 2022-03-18 |
| CVE-2026-25894FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration | frangoteam · FUXA | Unlikely | 9.5 | 0.8% | 2026-02-09 |
| CVE-2024-30207A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.… | Siemens · SIMATIC RTLS Locating Manager | Unlikely | 10.0 | 0.8% | 2024-05-14 |
| CVE-2026-125383INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypass | go2ismail · Asp.Net-Core-Inventory-Order-Management-System | Unlikely | 9.8 | 0.8% | 2026-11-09 |
| CVE-2021-22644Ovarro TBox Use of Hard-coded Cryptographic Key | Ovarro · TBox | Unlikely | 7.5 | 0.8% | 2022-07-28 |
| CVE-2022-1400Hardcoded encryption key IV in Exago WebReportsApi.dll | Device42 · CMDB | Unlikely | 7.1 | 0.8% | 2022-08-16 |
| CVE-2023-34123Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier… | SonicWall · GMS | Unlikely | – | 0.8% | 2023-07-12 |
| CVE-2026-35019NetComm NF20MESH < R6B032 Hardcoded AES Key Authentication Bypass | NetComm Wireless Pty Ltd · NF20MESH | Unlikely | 8.1 | 0.8% | 2026-06-23 |
| CVE-2022-20868A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an authentic… | Cisco · Cisco Secure Web Appliance | Unlikely | 4.7 | 0.8% | 2022-11-03 |
| CVE-2025-5164PerfreeBlog JWT JwtUtil hard-coded key | Perfree · PerfreeBlog | Unlikely | 3.7 | 0.8% | 2025-05-26 |
| CVE-2026-90945Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret | crawlab-team · crawlab | Unlikely | 9.8 | 0.8% | 2026-09-14 |
| CVE-2023-3632Hard-coded Cryptographic Key in Kunduz - Homework Helper App | Sifir Bes Education and Informatics · Kunduz - Homework Helper App | Unlikely | 9.8 | 0.8% | 2023-08-09 |
| CVE-2023-39465Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Cryptograhic Key Information Disclosure Vulnerability | Triangle MicroWorks · SCADA Data Gateway | Unlikely | 7.5 | 0.8% | 2024-05-03 |
| CVE-2023-22844An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authenti… | Milesight · MilesightVPN | Unlikely | 7.3 | 0.8% | 2023-07-06 |
| CVE-2025-54807Dover Fueling Solutions ProGauge MagLink LX 4 Devices Use of Hard-coded Cryptographic Key | Dover Fueling Solutions · ProGauge MagLink LX 4 | Unlikely | 9.8 | 0.7% | 2025-09-18 |
| CVE-2024-1920osuuu LightPicture TokenVerify.php handle hard-coded key | osuuu · LightPicture | Unlikely | 5.6 | 0.7% | 2024-02-27 |
| CVE-2025-34217Vasion Print (formerly PrinterLogic) Undocumented Hardcoded SSH Key | Vasion · Print Virtual Appliance Host | Unlikely | 10.0 | 0.7% | 2025-09-30 |
| CVE-2020-2500This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with A… | QNAP Systems Inc. · Helpdesk | Unlikely | 9.8 | 0.7% | 2020-07-01 |
| CVE-2025-34256Advantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication Bypass | Advantech Co., Ltd. · WISE-DeviceOn Server | Unlikely | 10.0 | 0.7% | 2025-12-05 |
| CVE-2024-6890Journyx Unauthenticated Password Reset Bruteforce | Journyx · Journyx (jtime) | Unlikely | 9.8 | 0.7% | 2024-08-07 |
| CVE-2025-27674Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Hardcoded IdP Key V-2023-006. | Printerlogic · Vasion Print | Unlikely | 9.8 | 0.7% | 2025-03-05 |
| CVE-2023-3404ProfileGrid <= 5.5.0 - Hardcoded Encryption Key | metagauss · ProfileGrid – User Profiles, Groups and Communities | Unlikely | 4.9 | 0.7% | 2023-08-31 |
| CVE-2026-28326SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability | SolarWinds · Access Rights Manager | Unlikely | 8.8 | 0.7% | 2026-09-17 |
| CVE-2023-44318Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with admini… | Siemens · RUGGEDCOM RM1224 LTE(4G) EU | Unlikely | 4.9 | 0.7% | 2023-11-14 |
| CVE-2026-54363CentreStack < 17.5 Hardcoded Key Token Forgery RCE | Gladinet · CentreStack | Unlikely | 9.1 | 0.7% | 2026-07-30 |
| CVE-2026-125370Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret | kubero-dev · kubero | Unlikely | 9.8 | 0.7% | 2026-11-09 |
| CVE-2022-26020An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead… | InHand Networks · InRouter302 | Unlikely | 6.3 | 0.7% | 2022-05-12 |
| CVE-2025-15627Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication | TP-Link Systems Inc. · Omada Gateways | Unlikely | 6.9 | 0.7% | 2026-08-03 |
| CVE-2024-30407[Child CVE] JCNR and cRPD: Hard-coded SSH host keys in cRPD may allow Person-in-the-Middle (PitM) attacks | Juniper Networks, Inc. · cRPD | Unlikely | 8.1 | 0.7% | 2024-04-12 |
| CVE-2025-11899Flowring Technology｜Agentflow - Use of Hard-coded Cryptographic Key | Flowring Technology · Agentflow | Unlikely | 8.1 | 0.7% | 2025-10-17 |
| CVE-2025-59407The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compu… | Flocksafety · Flock Safety | Unlikely | 9.8 | 0.7% | 2025-10-02 |
| CVE-2022-2660Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allow an attacker to decrypt sensitive data… | Delta Electronics · Industrial Automation DIALink | Unlikely | 9.8 | 0.7% | 2022-12-13 |
| CVE-2026-56271Flowise - Weak Default JWT Secrets in Authentication Middleware | Flowise · Flowise | Unlikely | 9.8 | 0.7% | 2026-07-12 |
| CVE-2018-3825In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless exp… | Elastic · Elastic Cloud Enterprise (ECE) | Unlikely | – | 0.7% | 2018-09-19 |
Data as of 2026-11-15.