Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-323
Weakness type CWE-323 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 14 | 14 | 0 |
Monthly trend
▇▅█▂▂
2026-06 4 · 2026-07 3 · 2026-08 5 · 2026-09 1 · 2026-10 1
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-49952 | 9.3 | 89.5 | — | Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle |
| CVE-2026-59099 | 9.3 | 44.7 | — | Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosure |
| CVE-2026-50577 | 7.4 | 42.5 | — | ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counter |
| CVE-2026-71884 | 8.2 | 33.7 | — | Packet CTR reports a full success length after the counter is exhausted |
| CVE-2026-81019 | 7.4 | 30.8 | — | wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record |
| CVE-2026-81020 | 7.4 | 30.8 | — | wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record |
| CVE-2026-13602 | 7.7 | 30.6 | — | Session takeover vulnerability |
| CVE-2026-81341 | 6.5 | 23.2 | — | wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records |
| CVE-2026-12205 | 9.1 | 20.0 | — | Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to… |
| CVE-2026-17578 | 2.3 | 14.6 | — | Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement |
| CVE-2026-56369 | 6.3 | 12.8 | — | ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage |
| CVE-2026-55967 | 2.0 | 7.3 | — | AES-GCM streaming APIs do not reject >64 GiB cumulative single messages, enabling count… |
| CVE-2026-21383 | 7.1 | 0.9 | — | Reusing a Nonce, Key Pair in Encryption in HLOS |
| CVE-2026-15890 | 5.3 | 0.0 | — | AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thr… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| wolfssl | 4 |
| apereo | 1 |
| discuz | 1 |
| fbeta-gmbh | 1 |
| imagemagick | 1 |
| kong | 1 |
| legion of the bouncy castle | 1 |
| pretix | 1 |
| qualcomm | 1 |
| timlegge | 1 |
| zephyrproject | 1 |
