Skip to content
OpenAdvisories

Weakness (CWE)

CWE-326: Inadequate Encryption Strength

Class Draft

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Use an encryption scheme that is currently considered to be strong by experts in the field.

Source: MITRE CWE-326

All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 7.1
    CVE-2026-63286 Public exploit

    Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are st…

    Axis Communications AB AXIS Camera Station Pro AXIS Camera Station 5
  • High 7.5
    CVE-2025-63579 Public exploit

    Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The sec…

  • Critical 9.1
    CVE-2026-44351 Public exploit

    fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When t…

    nearform fast-jwt fast-jwt npm
  • Medium 6.1
    CVE-2024-52318 Public exploit

    Apache Tomcat: Incorrect JSP tag recycling leads to XSS

    Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat10 Debian Maven
  • Medium 6.5
    CVE-2024-52317 Public exploit

    Apache Tomcat: Request/response mix-up with HTTP/2

    Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 throug…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat10 Debian Ubuntu Maven
  • High 7.5
    CVE-2024-36823 Public exploit

    Weak encryption in Ninja Core

    The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information.

    org.ninjaframework:ninja-core Maven
  • Medium 6.8
    CVE-2024-22894 Public exploit

    An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Nove…

  • High 7.8
    CVE-2023-21109 Public exploit

    In multiple places of AccessibilityService, there is a possible way to hide the app from the user due to a logic error …

    Android
  • High 7.5
    CVE-2022-35513 Public exploit

    Blink1Control2 uses weak password encryption

    The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.

    Blink1Control2 npm
  • High 7.5
    CVE-2022-2097 Public exploit

    AES OCB fails to encrypt some bytes

    AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine crates.io
  • High 7.5
    CVE-2018-18325 Exploited Public exploit EPSS 74%

    Inadequate Encryption Strength in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

    DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • High 7.5
    CVE-2018-15811 Exploited Public exploit EPSS 76%

    Inadequate Encryption Strength in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

    DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2017-1000486 Exploited Public exploit EPSS 94%

    Inadequate Encryption Strength

    Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

    org.primefaces:primefaces Maven
    KEV Jan 10, 2022
  • Critical 9.8
    CVE-2017-11317 Exploited Public exploit EPSS 84%

    Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUploa…

    KEV Apr 11, 2022
  • Medium —
    CVE-2012-5575 Public exploit

    Inadequate Encryption Strength in Apache CXF

    Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force…

    org.apache.cxf:cxf-rt-transports-http Maven
  • High 7.8
    CVE-2001-1546 Public exploit

    Pathways Homecare 6.5 uses weak encryption for user names and passwords, which allows local users to gain privileges by…