CVE-2026-80211

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5$POST'password' to adduser and updateuserpassword, admin/changecurrentuserpassword.php does the same when a user changes their own password, the forgotten-password path in...

CVE-2026-80211

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5$POST'password' to adduser and updateuserpassword, admin/changecurrentuserpassword.php does the same when a user changes their own password, the forgotten-password path in...

Rockwell Automation OTTO Fleet Manager

ADVISORY SUMMARY Successful exploitation of this vulnerability could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...

PT-2026-82563

Name of the Vulnerable Software and Affected Versions FrontAccounting versions prior to 2.4.21 Description User passwords are stored and verified as unsalted MD5 digests. The application fails to use per-password salts or adaptive hashing functions, meaning identical passwords result in identical...

bank-api-remediated

vulnbank-api — Remediated Fixed version of bank-api, built...

UBUNTU-CVE-2026-53525

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...

Improper Handling of Alternate Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Alternate Encoding in its password normalization, which applies Unicode NFKC compatibility normalization before hashing and so folds fullwidth and other compatibility characters to their ASCII equivalents. An attack...

CVE-2026-19611

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

CVE-2026-19611 Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

CVE-2026-19611 Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

EUVD-2026-63478

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

CVE-2026-19611

The vulnerable component is org.wildfly.security/wildfly-elytron-password-impl in WildFly Elytron. Password hashing/verification applies Unicode NFKC normalization, collapsing fullwidth characters to ASCII equivalents, which reduces the effective password keyspace. This allows a remote attacker t...

CVE-2026-19611

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

CVE-2026-19611

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

CVE-2026-19611: Improper Handling of Alternate Encoding

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

PT-2026-79049

Name of the Vulnerable Software and Affected Versions WildFly Elytron affected versions not specified Description Password hashing and verification processes normalize input using Unicode NFKC Normalization Form Compatibility Composition, which can collapse fullwidth characters into their ASCII...

CVE-2026-75112

OTTO® Fleet Manager uses an insufficient bcrypt work factor, lowering the computational cost for offline brute-force attacks on stored password hashes if an attacker obtains an unencrypted system backup. CVSS 6.9 (Medium), ADJACENT vector. No exploitation reported; Rockwell advisory SD1791 refere...

CVE-2026-75112 OTTO® Fleet Manager – Weak Password Hashing Configuration

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

EUVD-2026-62694

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

CVE-2026-75112: Use of Password Hash With Insufficient Computational Effort

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...