CWE-328 · Cryptography
Use of Weak Hash
90CVEs
SortMost likely exploited
90 CVEs with CWE-328 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-3596RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.IETF · RFC · CVSS 9 · 2024-07-09 | 9.0 | 15% | 2024-07-09 |
| CVE-2004-2761The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the u…Ietf · Md5 · CVSS 9.8 · 2009-01-05 | 9.8 | 10% | 2009-01-05 |
| CVE-2024-54143openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injectionopenwrt · asu · CVSS 9.3 · 2024-12-06 | 9.3 | 1.8% | 2024-12-06 |
| CVE-2022-3433The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers librar…Haskell · aeson · 2022-10-10 | – | 0.9% | 2022-10-10 |
| CVE-2022-29249Reversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZJavaEZLib · JavaEZ · CVSS 7.5 · 2022-05-24 | 7.5 | 0.7% | 2022-05-24 |
| CVE-2023-2900NFine Rapid Development Platform CheckLogin weak hashNFine · Rapid Development Platform · CVSS 3.7 · 2023-05-25 | 3.7 | 0.7% | 2023-05-25 |
| CVE-2023-0452Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials. A configuration file that is accessible without authentication uses MD…Econolite · EOS · CVSS 9.8 · 2023-01-26 | 9.8 | 0.6% | 2023-01-26 |
| CVE-2025-27595Weak hashing alghrythmSICK AG · SICK DL100-2xxxxxxx · CVSS 9.8 · 2025-03-14 | 9.8 | 0.5% | 2025-03-14 |
| CVE-2025-41652Weidmueller: Authentication Bypass Vulnerability in Industrial Ethernet SwitchesWeidmueller · IE-SW-VL05M-5TX · CVSS 9.8 · 2025-05-27 | 9.8 | 0.5% | 2025-05-27 |
| CVE-2026-51996An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash functionNo vendor recorded · CVSS 9.8 · 2026-09-24 | 9.8 | 0.5% | 2026-09-24 |
| CVE-2022-45141Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable S…Samba · Samba · CVSS 9.8 · 2023-03-06 | 9.8 | 0.5% | 2023-03-06 |
| CVE-2023-44319A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8…Siemens · RUGGEDCOM RM1224 LTE(4G) EU · CVSS 4.9 · 2023-11-14 | 4.9 | 0.4% | 2023-11-14 |
| CVE-2024-40465An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go fileBeego · Beego · CVSS 8.8 · 2024-07-31 | 8.8 | 0.4% | 2024-07-31 |
| CVE-2024-52521Nextcloud Server has a potential hash collision for background jobs could skip queuing themnextcloud · security-advisories · CVSS 2.6 · 2024-11-15 | 2.6 | 0.4% | 2024-11-15 |
| CVE-2026-40164jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seedjqlang · jq · CVSS 7.5 · 2026-04-13 | 7.5 | 0.4% | 2026-04-13 |
| CVE-2024-48924MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflowMessagePack-CSharp · MessagePack-CSharp · CVSS 8.7 · 2024-10-17 | 8.7 | 0.4% | 2024-10-17 |
| CVE-2022-43922IBM App Connect Enterprise Certified Container information disclosureIBM · App Connect Enterprise Certified Container · CVSS 5.3 · 2023-02-01 | 5.3 | 0.4% | 2023-02-01 |
| CVE-2025-3576Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisionsSiemens · krb5 · CVSS 5.9 · 2025-04-15 | 5.9 | 0.4% | 2025-04-15 |
| CVE-2024-56516free-one-api uses md5 for password storageRockChinQ · free-one-api · CVSS 6.9 · 2024-12-30 | 6.9 | 0.3% | 2024-12-30 |
| CVE-2024-55885Beego Vulnerable to Collision Hazards of MD5 in Cache Key Filenamesbeego · beego · CVSS 6.9 · 2024-12-12 | 6.9 | 0.3% | 2024-12-12 |
| CVE-2025-49197Deprecated TLS version supportedSICK AG · SICK Media Server · CVSS 6.5 · 2025-06-12 | 6.5 | 0.3% | 2025-06-12 |
| CVE-2025-14636Tenda AX9 httpd image_check weak hashTenda · AX9 · CVSS 3.7 · 2025-12-13 | 3.7 | 0.3% | 2025-12-13 |
| CVE-2026-14738exo-explore exo Vision Feature Cache vision.py _image_cache_key weak hashexo-explore · exo · CVSS 3.7 · 2026-07-05 | 3.7 | 0.3% | 2026-07-05 |
| CVE-2026-13510SimStudioAI sim Password Protection deployment.ts weak hashSimStudioAI · sim · CVSS 3.7 · 2026-06-28 | 3.7 | 0.3% | 2026-06-28 |
| CVE-2025-47276Actualizer Uses OpenSSL's "-passwd" Function Which Uses SHA512 Under The Hood Instead of Proper Password Hasher like Yescript/Argon2iChewKeanHo · Actualizer · CVSS 7.5 · 2025-05-13 | 7.5 | 0.3% | 2025-05-13 |
| CVE-2024-34914php-censor v2.1.4 and fixed in v.2.1.5 was discovered to utilize a weak hashing algorithm for its remember_key value. This allows attackers to bruteforce to bruteforce the remembe…No vendor recorded · CVSS 5.3 · 2024-05-14 | 5.3 | 0.3% | 2024-05-14 |
| CVE-2026-13482skypilot-org skypilot User ID server.py username.encode weak hashskypilot-org · skypilot · CVSS 3.7 · 2026-06-28 | 3.7 | 0.3% | 2026-06-28 |
| CVE-2023-5962ioLogik E1200 Series: Weak Cryptographic Algorithm VulnerabilityMoxa · ioLogik E1200 Series · CVSS 6.5 · 2023-12-23 | 6.5 | 0.3% | 2023-12-23 |
| CVE-2025-8260Vaelsys VaelsysV4 Web interface vgrid_server.php weak hashVaelsys · VaelsysV4 · CVSS 3.1 · 2025-07-28 | 3.1 | 0.3% | 2025-07-28 |
| CVE-2026-21717A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that c…nodejs · node · CVSS 5.9 · 2026-03-30 | 5.9 | 0.3% | 2026-03-30 |
| CVE-2026-41879Weak password hashing in R-SOFT DMSR-SOFT SERWIS · DMS · CVSS 8.2 · 2026-07-10 | 8.2 | 0.3% | 2026-07-10 |
| CVE-2025-21604LangChain4j-AIDeepin Using MD5 to Hash files may cause file upload conflictsmoyangzhan · langchain4j-aideepin · CVSS 6.9 · 2025-01-06 | 6.9 | 0.3% | 2025-01-06 |
| CVE-2019-13539Medtronic Valleylab FT10 and FX8 Reversible One-way HashMedtronic · Valleylab Exchange Client · CVSS 7 · 2019-11-08 | 7.0 | 0.3% | 2019-11-08 |
| CVE-2025-0508MD5 Hash Collision in SageMaker Workflow in aws/sagemaker-python-sdkaws · aws/sagemaker-python-sdk · CVSS 5.9 · 2025-03-20 | 5.9 | 0.3% | 2025-03-20 |
| CVE-2025-31130gitoxide does not detect SHA-1 collision attacksGitoxideLabs · gitoxide · CVSS 6.8 · 2025-04-04 | 6.8 | 0.3% | 2025-04-04 |
| CVE-2024-48847MD5 bypass operationABB · ASPECT-Enterprise · CVSS 8.2 · 2024-12-05 | 8.2 | 0.3% | 2024-12-05 |
| CVE-2026-8889CVE-2026-8889Securly · Securly Chrome Extension · CVSS 7.5 · 2026-06-03 | 7.5 | 0.2% | 2026-06-03 |
| CVE-2025-55053CWE-328: Use of Weak HashBaicells · NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846 · CVSS 6.5 · 2025-09-09 | 6.5 | 0.2% | 2025-09-09 |
| CVE-2020-37168Ecommerce Systempay 1.0 Production Key Brute ForcePaiement · Ecommerce Systempay · CVSS 9.8 · 2026-05-13 | 9.8 | 0.2% | 2026-05-13 |
| CVE-2026-7103code-projects Chat System MD5 Hash update_user.php weak hashcode-projects · Chat System · CVSS 3.7 · 2026-04-27 | 3.7 | 0.2% | 2026-04-27 |
| CVE-2024-47829pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwritingpnpm · pnpm · CVSS 6.5 · 2025-04-23 | 6.5 | 0.2% | 2025-04-23 |
| CVE-2024-38341IBM Sterling Secure Proxy information disclosureIBM · Sterling Secure Proxy · CVSS 5.9 · 2025-05-28 | 5.9 | 0.2% | 2025-05-28 |
| CVE-2026-32129Poseidon V1 variable-length input collision via implicit zero-paddingstellar · rs-soroban-poseidon · CVSS 8.7 · 2026-03-12 | 8.7 | 0.2% | 2026-03-12 |
| CVE-2026-15605wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hashwandb · CVSS 3.1 · 2026-07-13 | 3.1 | 0.2% | 2026-07-13 |
| CVE-2026-14742langchain-ai langgraph Task Result Cache _cache.py _freeze weak hashlangchain-ai · langgraph · CVSS 3.1 · 2026-07-05 | 3.1 | 0.2% | 2026-07-05 |
| CVE-2026-14630ForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hashForceInjection · AI-fundermentals · CVSS 3.1 · 2026-07-04 | 3.1 | 0.2% | 2026-07-04 |
| CVE-2024-10026Improved Seeding and Hashing In gVisorGoogle · gVisor · CVSS 6.3 · 2025-01-30 | 6.3 | 0.2% | 2025-01-30 |
| CVE-2026-97468Apache CXF: Authentication bypass via weak cache keys for validated STS tokensApache Software Foundation · Apache CXF · CVSS 9.1 · 2026-10-09 | 9.1 | 0.2% | 2026-10-09 |
| CVE-2026-44582Next.js: Cache poisoning via collisions in React Server Component cache-bustingvercel · next.js · CVSS 3.7 · 2026-05-13 | 3.7 | 0.2% | 2026-05-13 |
| CVE-2025-54535In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithmsJetBrains · TeamCity · CVSS 5.8 · 2025-07-28 | 5.8 | 0.2% | 2025-07-28 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.