Weaknesses of type CWE-326

208 results

Força criptográfica inadequada

A aplicação usa algoritmos ou tamanhos de chave criptográfica insuficientes para proteger dados sensíveis contra ataques conhecidos. Por exemplo, usar DES, MD5 ou chaves RSA de 512 bits fornece proteção que pode ser quebrada em tempo viável com poder computacional moderno, deixando dados expostos.

Example

Um sistema de autenticação que armazena senhas hasheadas com MD5, ou uma API que criptografa dados com DES em vez de AES-256. Um atacante com acesso aos hashes consegue recuperar as senhas por força bruta, ou quebra a criptografia DES em horas.

How to mitigate

Use algoritmos reconhecidos como seguro (AES-256 para cifra simétrica, RSA 2048+ ou ECDSA para assimétrica, bcrypt/scrypt/argon2 para senhas). Revise regularmente o padrão criptográfico da sua stack — o que era seguro em 2015 pode estar comprometido hoje.

CVE-2026-35146MEDIUMHCL DFXServer is affected by an Unencrypted Communication vulnerability.EPSS 0.2%CVE-2026-105156MEDIUMYzmCMS MD5 system.func.php password weak password hashEPSS 0.2%CVE-2023-1764MEDIUMCanon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 1EPSS 0.2%CVE-2026-17520MEDIUMNewsletters < 4.17 - Unauthenticated API Access via Predictable API KeyEPSS 0.2%CVE-2024-40719MEDIUMCHANGING Information Technology TCBServiSign Windows Version - Inadequate Encryption StrengthEPSS 0.2%CVE-2025-7398HIGHMedium Strength Cipher Suites detected on port on ports 9000 and 8036EPSS 0.2%CVE-2021-38121HIGHWeak communication protocol identified in Advance Authentication client applicationEPSS 0.2%CVE-2022-32753MEDIUMIBM Security Verify Directory information disclosureEPSS 0.2%CVE-2025-46409HIGHInadequate encryption strength issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If this vulnerability is eEPSS 0.2%CVE-2024-43382MEDIUMSnowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypEPSS 0.2%CVE-2024-28860HIGHInsecure IPsec transport encryption in CiliumEPSS 0.2%CVE-2025-45765CRITICALruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is "keysize is not something that is enforEPSS 0.2%CVE-2026-49852HIGHjoserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)EPSS 0.2%CVE-2022-41209MEDIUMSAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide EPSS 0.2%CVE-2026-81718HIGHopenssl_encrypt before 1.4.9 Weak Cryptographic ParametersEPSS 0.2%CVE-2024-3387MEDIUMPAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information DisclosureEPSS 0.2%CVE-2023-32414—The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.4. An app may be able to break out of its sandbox.EPSS 0.2%CVE-2024-42177LOWHCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilitiesEPSS 0.2%CVE-2026-33361HIGHMeari weak XOR obfuscationEPSS 0.2%CVE-2025-36379MEDIUMIBM Security QRadar EDR Software has multiple vulnerabilitiesEPSS 0.2%