CWE-328 Use of Weak Hash

Flowise has Insufficient Password Salt Rounds

@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

motionEye: Authentication possible via password hash

Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

Plonky3: The sponge construction used to get a hash function from a cryptographic permutation is not collision resistant for inputs of different lengths

Poseidon V1 variable-length input collision via implicit zero-padding

OpenClaw replaced a deprecated sandbox hash algorithm

@keep-network/tbtc-v2 revealing P2PKH deposit with a wrapped P2SH script

Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations

EVE Seals Vault Key With SHA1 PCRs

Duplicate Advisory: EVE Seals Vault Key With SHA1 PCRs

EVE Doesn't Measure Config Partition From 2 Fronts

Duplicate Advisory: EVE Doesn't Measure Config Partition From 2 Fronts

gitoxide does not detect SHA-1 collision attacks

DragonFly has weak integrity checks for downloaded files

Mattermost makes Use of Weak Hash

pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

Jujutsu does not have SHA-1 collision detection

SageMaker Workflow component allows possibility of MD5 hash collisions

Beego has Collision Hazards of MD5 in Cache Key Filenames

OpenStack Glance Signature Verification Bypass

MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow

Dozzle uses unsafe hash for passwords

Improper hashing in enrocrypt