CVE-2026-94206 Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloakecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that...

CVE-2026-94206

The cloak_ecto and cloak libraries (by danielberkompas) are vulnerable to a Use of Password Hash With Insufficient Computational Effort (CWE-916) flaw. Specifically, the Cloak.Ecto.PBKDF2 (formerly Cloak.Fields.PBKDF2) component incorrectly passes the :size configuration value into the iteration-...

EEF-CVE-2026-94206 Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds

Summary Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloakecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback...

EUVD-2026-93091

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloakecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that...

CVE-2026-94206 Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloakecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that...

CVE-2026-94206 Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloakecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that...

PT-2026-106488

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that...

CVE-2026-105156 YzmCMS MD5 system.func.php password weak password hash

A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launch...

CVE-2026-104844

A flaw was found in postcss-selector-parser. A remote attacker could exploit this vulnerability by submitting a specially crafted CSS selector containing numerous class or ID identifiers to an application that parses untrusted input. Due to inefficient processing and repeated scanning during...

CVE-2026-86670

aircheng-org iWebShop-5 versions up to 5.15 contain a vulnerability in the Authentication Storage component within the file controllers/admin.php . Manipulating the Password argument can result in a password hash with insufficient computational effort , effectively weakening credential protection...

CVE-2026-81689: Use of Password Hash With Insufficient Computational Effort

opensslencrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide...

CVE-2026-49005: Use of Password Hash With Insufficient Computational Effort

The root password hash of the device can be obtained through unencrypted information in the firmware...

CVE-2026-55069: Use of Password Hash With Insufficient Computational Effort

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computatio...

Tridium Niagara Use of Password Hash With Insufficient Computational Effort (CVE-2025-3937)

Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niaga...

CVE-2026-56272: Use of Password Hash With Insufficient Computational Effort

Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password hashes approximately 30 times faster with modern GPU hardware, potentially compromising all user accounts in a database...

Use of Password Hash With Insufficient Computational Effort

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Use of Password Hash With Insufficient Computational Effort due to the use of insufficient bcrypt salt rounds in the getHash function. An attacker can significantly reduce the time required to crack passwor...

CVE-2026-30789 RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force

Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android Client login, peer authentication modules allows Password Brute Forcing. T...

CVE-2026-30785: Storing Passwords in a Recoverable Format

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution', Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk, hbbcommon on Windows, MacOS, Linux Password security module, config encryption, machine U...

CVE-2025-67168: Use of Password Hash With Insufficient Computational Effort

RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords...

Use of password hash with insufficient computational effort vulnerability in BUFFALO Wi-Fi router "WSR-1800AX4 series"

Overview Wi-Fi router "WSR-1800AX4 series" provided by BUFFALO INC. contains the following vulnerability. Use of password hash with insufficient computational effort CWE-916 - CVE-2025-46413 Kazuaki Chikamori and Takayuki Tatekawa of National Institute of Technology, Kochi College reported this...