Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-916
Weakness type CWE-916 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 31 | 31 | 0 |
Monthly trend
▄▅▃▆▄█
2026-05 4 · 2026-06 5 · 2026-07 2 · 2026-08 7 · 2026-09 4 · 2026-10 9
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-86670 | 2.9 | 30.8 | — | aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash |
| CVE-2026-85497 | 9.3 | 26.4 | — | CareCam CM2507 Use of Password Hash With Insufficient Computational Effort |
| CVE-2026-80211 | 8.2 | 22.0 | — | FrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage |
| CVE-2026-92921 | 6.9 | 21.4 | — | admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5 |
| CVE-2026-9641 | 5.3 | 19.9 | — | Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and numbe… |
| CVE-2026-110104 | 8.2 | 19.6 | — | novel through 3.5.0 Unsalted MD5 Password Storage |
| CVE-2026-57310 | 6.3 | 19.1 | — | Weak password hashing in Windu CMS |
| CVE-2026-81689 | 8.7 | 18.2 | — | openssl_encrypt before 1.4.9 Weak Pepper Key Derivation |
| CVE-2026-81704 | 8.7 | 18.2 | — | openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus |
| CVE-2026-25861 | 8.2 | 18.0 | — | QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php |
| CVE-2026-94206 | 6.3 | 16.1 | — | Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds |
| CVE-2026-55069 | 8.7 | 14.5 | — | Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack |
| CVE-2026-40522 | 7.1 | 13.2 | — | FrontAccounting < 2.4.20 SQL Injection via rep601.php |
| CVE-2026-111330 | 8.2 | 11.8 | — | JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1 |
| CVE-2026-62376 | 8.1 | 11.0 | — | Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables a… |
| CVE-2026-45027 | 5.9 | 10.3 | — | WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.php |
| CVE-2026-107829 | 8.2 | 8.7 | — | Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql |
| CVE-2026-44611 | 5.9 | 8.6 | — | MacGregor Voyage Data Recorder (VDR) G4e Use of Password Hash With Insufficient Computa… |
| CVE-2026-105156 | 2.9 | 7.8 | — | YzmCMS MD5 system.func.php password weak password hash |
| CVE-2026-75112 | 6.9 | 5.2 | — | OTTO® Fleet Manager – Weak Password Hashing Configuration |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| jahlives | 3 |
| frontaccounting | 2 |
| aircheng-org | 1 |
| arodland | 1 |
| banq | 1 |
| carecam | 1 |
| cisa | 1 |
| cjbi | 1 |
| danelec | 1 |
| danielberkompas | 1 |
| diem-project | 1 |
| electerm | 1 |
| flowise | 1 |
| go-vikunja | 1 |
| jcd | 1 |
