Common Weakness Enumeration

CWE-326 Inadequate Encryption Strength

Description

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-326 ordered by modification date.

25 reviewed records
Advisory ID NVD ID Severity PURLs Summary Last Modified
GHSA-33mj-cw25-m34h CVE-2026-77405 CRITICAL
golang/github.com/rabbitmq/amqp091-go

RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser

 2026-09-17
GHSA-ffqx-q65f-36jf CVE-2026-28377 HIGH
golang/github.com/grafana/tempo

Grafana Tempo has Inadequate Encryption Strength

 2026-07-21
GHSA-gg9x-qcx2-xmrh CVE-2026-49852 HIGH
pypi/joserfc

joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

 2026-07-02
GHSA-gxhx-2686-5h9g - MODERATE
golang/github.com/slack-go/slack

slack-go `SecretsVerifier` accepts empty signing secret without precondition

 2026-06-29
GHSA-f632-9449-3j4w CVE-2024-52318 MODERATE
maven/org.apache.tomcat.embed/tomcat-embed-jasper maven/org.apache.tomcat/tomcat maven/org.apache.tomcat/tomcat-jasper

Apache Tomcat - XSS in generated JSPs

 2026-06-18
GHSA-g29v-q6h7-76wh CVE-2026-45787 MODERATE
npm/electerm

electerm's encrypt method not safe enough

 2026-06-09
GHSA-6p6v-m64v-jx8q CVE-2025-55039 LOW
maven/org.apache.spark/spark-network-common_2.12 maven/org.apache.spark/spark-network-common_2.13 pypi/pyspark

Apache Spark has Inadequate Encryption Strength

 2026-06-08
GHSA-c32j-vqhx-rx3x CVE-2026-45363 HIGH
gem/jwt

ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351

 2026-06-02
GHSA-q6mh-rqwh-g786 CVE-2026-44523 CRITICAL
golang/github.com/enchant97/note-mark/backend

Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery

 2026-05-15
GHSA-gmvf-9v4p-v8jc CVE-2026-44351 CRITICAL
npm/fast-jwt

fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver

 2026-05-14
GHSA-565h-44m8-4c2v CVE-2025-7789 LOW
maven/com.xuxueli/xxl-job-admin

xxl-job has Inadequate Encryption Strength

2026-05-07
GHSA-6m5f-j7w2-w953 CVE-2026-33488 HIGH -

AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin

 2026-03-25
GHSA-mwjc-5j4x-r686 CVE-2026-33512 HIGH -

AVideo has an unauthenticated decrypt oracle leaking any ciphertext

 2026-03-25
GHSA-2x45-7fc3-mxwq CVE-2025-45769 LOW -

php-jwt contains weak encryption

 2026-02-27
GHSA-6jvc-q2x7-pchv CVE-2022-2582 MODERATE
golang/github.com/aws/aws-sdk-go

AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field

 2026-02-03
GHSA-36h5-vrq6-pp34 CVE-2025-68703 HIGH
maven/net.gleske/jervis

Jervis's Salt for PBKDF2 derived from password

 2026-01-21
GHSA-vc89-hccf-rq55 CVE-2022-21653 MODERATE
maven/org.typelevel/jawn-parser_0.25 maven/org.typelevel/jawn-parser_0.27 maven/org.typelevel/jawn-parser_2.10 maven/org.typelevel/jawn-parser_2.11 maven/org.typelevel/jawn-parser_2.12 maven/org.typelevel/jawn-parser_2.13 maven/org.typelevel/jawn-parser_2.13.0-M5 maven/org.typelevel/jawn-parser_2.13.0-RC1 maven/org.typelevel/jawn-parser_2.13.0-RC2 maven/org.typelevel/jawn-parser_2.13.0-RC3 maven/org.typelevel/jawn-parser_3 maven/org.typelevel/jawn-parser_3.0.0-M1 maven/org.typelevel/jawn-parser_3.0.0-M2 maven/org.typelevel/jawn-parser_3.0.0-M3 maven/org.typelevel/jawn-parser_3.0.0-RC1 maven/org.typelevel/jawn-parser_3.0.0-RC2 maven/org.typelevel/jawn-parser_3.0.0-RC3 maven/org.typelevel/jawn-parserg

Hash collision in typelevel jawn

 2025-12-16
GHSA-j3g9-6fx5-gjv7 CVE-2018-18325 HIGH
nuget/DotNetNuke.Core

Inadequate Encryption Strength in DotNetNuke

 2025-10-22
GHSA-h595-8pw6-5q6v CVE-2018-15811 HIGH
nuget/DotNetNuke.Core

Inadequate Encryption Strength in DotNetNuke

 2025-10-22
GHSA-gwq6-fmvp-qp68 CVE-2025-55248 MODERATE
nuget/Microsoft.NetCore.App.Runtime.linux-arm nuget/Microsoft.NetCore.App.Runtime.linux-arm64 nuget/Microsoft.NetCore.App.Runtime.linux-musl-arm nuget/Microsoft.NetCore.App.Runtime.linux-musl-arm64 nuget/Microsoft.NetCore.App.Runtime.linux-musl-x64 nuget/Microsoft.NetCore.App.Runtime.linux-x64 nuget/Microsoft.NetCore.App.Runtime.osx-arm64 nuget/Microsoft.NetCore.App.Runtime.osx-x64 nuget/Microsoft.NetCore.App.Runtime.win-arm nuget/Microsoft.NetCore.App.Runtime.win-arm64 nuget/Microsoft.NetCore.App.Runtime.win-x64 nuget/Microsoft.NetCore.App.Runtime.win-x86

Microsoft Security Advisory CVE-2025-55248: .NET Information Disclosure Vulnerability

 2025-10-15
GHSA-987x-96fq-9384 - MODERATE
nuget/Microsoft.NetCore.App.Runtime.linux-arm

Duplicate Advisory: Microsoft Security Advisory CVE-2025-55248: .NET Information Disclosure Vulnerability

 2025-10-15
GHSA-w285-wf9q-5w69 CVE-2016-1000352 HIGH
maven/org.bouncycastle/bcprov-jdk14 maven/org.bouncycastle/bcprov-jdk15 maven/org.bouncycastle/bcprov-jdk15on

In Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB mode

 2025-09-12
GHSA-48cr-j2cx-mcr8 CVE-2024-40761 MODERATE
golang/github.com/apache/incubator-answer

Apache Answer: Avatar URL leaked user email addresses

 2025-07-11
GHSA-gr79-9v6v-gc9r CVE-2024-23656 HIGH
golang/github.com/dexidp/dex

Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

 2025-05-27
GHSA-6gch-63wp-4v5f CVE-2024-39928 HIGH
maven/org.apache.linkis/linkis-engineplugin-spark

Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability

 2025-05-16