CWE-325 · Cryptography
Missing Cryptographic Step
63CVEs
SortMost likely exploited
63 CVEs with CWE-325 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-22946A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_S…Haxx · https://github.com/curl/curl · CVSS 7.5 · 2021-09-29 | 7.5 | 4.5% | 2021-09-29 |
| CVE-2020-15086Potential Remote Code Execution in TYPO3 with mediace extensionFriendsOfTYPO3 · mediace · CVSS 9.8 · 2020-07-29 | 9.8 | 3.6% | 2020-07-29 |
| CVE-2021-33560Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window si…Gnupg · Libgcrypt · CVSS 7.5 · 2021-06-08 | 7.5 | 2.4% | 2021-06-08 |
| CVE-2020-15098Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMSTYPO3 · TYPO3 CMS · CVSS 8.8 · 2020-07-29 | 8.8 | 2.2% | 2020-07-29 |
| CVE-2019-3738RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulner…Dell · RSA BSAFE Crypto-J · CVSS 6.5 · 2019-09-18 | 6.5 | 1.7% | 2019-09-18 |
| CVE-2016-9574nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.Mozilla · nss · CVSS 5.9 · 2018-07-19 | 5.9 | 1.4% | 2018-07-19 |
| CVE-2022-30115Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be…Haxx · https://github.com/curl/curl · 2022-06-01 | – | 1.4% | 2022-06-01 |
| CVE-2017-2600In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of…Jenkins · jenkins · CVSS 4.3 · 2018-05-15 | 4.3 | 1.0% | 2018-05-15 |
| CVE-2017-2598Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (S…Jenkins · jenkins · CVSS 4.3 · 2018-05-23 | 4.3 | 1.0% | 2018-05-23 |
| CVE-2017-2603Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362).Jenkins · jenkins · CVSS 2.6 · 2018-05-15 | 2.6 | 1.0% | 2018-05-15 |
| CVE-2020-26244Cryptographic issues in Python oicOpenIDC · pyoidc · CVSS 6.8 · 2020-12-02 | 6.8 | 0.8% | 2020-12-02 |
| CVE-2018-5383Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchangeApple · macOS · CVSS 8 · 2018-08-07 | 8.0 | 0.8% | 2018-08-07 |
| CVE-2026-45445AES-OCB IV Ignored on EVP_Cipher() PathOpenSSL · OpenSSL · CVSS 7.5 · 2026-06-09 | 7.5 | 0.7% | 2026-06-09 |
| CVE-2023-28998Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keysnextcloud · security-advisories · CVSS 6.7 · 2023-04-04 | 6.7 | 0.7% | 2023-04-04 |
| CVE-2023-28999Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE foldersnextcloud · security-advisories · CVSS 6.9 · 2023-04-04 | 6.9 | 0.7% | 2023-04-04 |
| CVE-2024-43547Windows Kerberos Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 6.5 · 2024-10-08 | 6.5 | 0.7% | 2024-10-08 |
| CVE-2023-39199Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access.Zoom Video Communications, Inc. · Zoom Clients · CVSS 4.9 · 2023-11-14 | 4.9 | 0.6% | 2023-11-14 |
| CVE-2025-60704Windows Kerberos Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.5 · 2025-11-11 | 7.5 | 0.6% | 2025-11-11 |
| CVE-2026-42770FFC-DH Peer Validation Uses Attacker-Supplied qOpenSSL · OpenSSL · CVSS 3.7 · 2026-06-09 | 3.7 | 0.5% | 2026-06-09 |
| CVE-2026-109839IBM Db2 Genius Hub Missing Cryptographic StepIBM · Db2 Genius Hub · CVSS 3.1 · 2026-10-16 | 3.1 | 0.5% | 2026-10-16 |
| CVE-2022-20742Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IPsec IKEv2 VPN Information Disclosure VulnerabilityCisco · Cisco Adaptive Security Appliance (ASA) Software · CVSS 7.4 · 2022-05-03 | 7.4 | 0.5% | 2022-05-03 |
| CVE-2021-3680Missing Cryptographic Step in star7th/showdocstar7th · star7th/showdoc · CVSS 5.3 · 2021-08-04 | 5.3 | 0.5% | 2021-08-04 |
| CVE-2022-20793Cisco Touch 10 Device Insufficient Identity Verification VulnerabilityCisco · Cisco RoomOS Software · CVSS 6.8 · 2024-11-15 | 6.8 | 0.4% | 2024-11-15 |
| CVE-2026-45446Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modesOpenSSL · OpenSSL · CVSS 4.8 · 2026-06-09 | 4.8 | 0.4% | 2026-06-09 |
| CVE-2022-1279Insecure EBICS messages encryption implementation in ebics-java/ebics-java-client could allow an adjacent attacker to decrypt EBICS payloadsebics-java · ebics-java-client · CVSS 6.5 · 2022-04-14 | 6.5 | 0.4% | 2022-04-14 |
| CVE-2022-29229Missing Cryptographic Step in cassprojectcassproject · CASS · CVSS 6.3 · 2022-05-18 | 6.3 | 0.4% | 2022-05-18 |
| CVE-2025-3938Missing Cryptographic StepTridium · Niagara Framework · CVSS 6.8 · 2025-05-22 | 6.8 | 0.3% | 2025-05-22 |
| CVE-2020-10702A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the…The QEMU Project · qemu · CVSS 5.5 · 2020-06-04 | 5.5 | 0.3% | 2020-06-04 |
| CVE-2026-4601Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation.…Kjur · jsrsasign · CVSS 8.7 · 2026-03-23 | 8.7 | 0.3% | 2026-03-23 |
| CVE-2022-24116Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0.Ge · Inet 900 Firmware · CVSS 9.8 · 2022-12-26 | 9.8 | 0.3% | 2022-12-26 |
| CVE-2025-58359frost-core: refresh shares with smaller min_signers will reduce group securityZcashFoundation · frost · CVSS 6 · 2025-09-04 | 6.0 | 0.3% | 2025-09-04 |
| CVE-2023-34471Missing Cryptographic StepAMI · MegaRAC_SPx · CVSS 6.3 · 2023-07-05 | 6.3 | 0.3% | 2023-07-05 |
| CVE-2025-30147ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curvehyperledger · besu-native · CVSS 8.7 · 2025-05-07 | 8.7 | 0.3% | 2025-05-07 |
| CVE-2024-55655sigstore-python has insufficient validation of integration timestamp during verificationsigstore · sigstore-python · CVSS 2.7 · 2024-12-10 | 2.7 | 0.3% | 2024-12-10 |
| CVE-2023-40012uthenticode EKU validation bypasstrailofbits · uthenticode · CVSS 5.9 · 2023-08-09 | 5.9 | 0.2% | 2023-08-09 |
| CVE-2026-117957Cryptographic issue in the WebRTC: Networking componentMozilla · Firefox · CVSS 8.1 · 2026-10-27 | 8.1 | 0.2% | 2026-10-27 |
| CVE-2026-81235Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cryptographic Step vulnerability. A high privileged attacker with remote access could potentially exp…Dell · Wyse Management Suite · CVSS 8 · 2026-09-15 | 8.0 | 0.2% | 2026-09-15 |
| CVE-2026-49440Deno: Miller-Rabin Primality Test Allows Zero Roundsdenoland · deno · CVSS 7.4 · 2026-06-23 | 7.4 | 0.2% | 2026-06-23 |
| CVE-2026-58638Windows Boot Loader Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 6 · 2026-07-14 | 6.0 | 0.2% | 2026-07-14 |
| CVE-2026-55144Windows Cryptography API: Next Generation (CNG) Tampering VulnerabilityMicrosoft · Windows 11 Version 24H2 · CVSS 7.1 · 2026-07-14 | 7.1 | 0.2% | 2026-07-14 |
| CVE-2026-16000KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is usedLegion of the Bouncy Castle Inc. · bc-csharp · CVSS 8.7 · 2026-10-02 | 8.7 | 0.2% | 2026-10-02 |
| CVE-2026-101294IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic stepIBM · WebSphere Application Server - Liberty · CVSS 8.7 · 2026-10-13 | 8.7 | 0.2% | 2026-10-13 |
| CVE-2026-22863Deno node:crypto doesn't finalize cipherdenoland · deno · CVSS 9.2 · 2026-01-15 | 9.2 | 0.2% | 2026-01-15 |
| CVE-2026-76784Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home DevicesTP-Link Systems Inc. · HS103P3 / HS103P4 v5 · CVSS 8.7 · 2026-08-26 | 8.7 | 0.2% | 2026-08-26 |
| CVE-2026-6458AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is EmptyCaliptra · Core Runtime Firmware · CVSS 5.1 · 2026-06-23 | 5.1 | 0.2% | 2026-06-23 |
| CVE-2026-100798Cryptography misuse in Storage: Quota Manager componentMozilla · Firefox · CVSS 8.1 · 2026-09-29 | 8.1 | 0.2% | 2026-09-29 |
| CVE-2026-17666Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discretionary access control via malicious…Google · Chrome · CVSS 9.1 · 2026-07-30 | 9.1 | 0.2% | 2026-07-30 |
| CVE-2026-59776Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is exploited, information stored in the IC chi…Sony Corporation · FeliCa IC chips · CVSS 7 · 2026-07-21 | 7.0 | 0.2% | 2026-07-21 |
| CVE-2026-59586In multiple locations, there is a possible way to recover cryptographic keys and forge authentication tags due to improperly used crypto. This could lead to local information disc…Google · Android · CVSS 4 · 2026-11-10 | 4.0 | 0.2% | 2026-11-10 |
| CVE-2026-48480netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncationnetty · netty-incubator-codec-ohttp · CVSS 6.6 · 2026-06-04 | 6.6 | 0.2% | 2026-06-04 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.