By weakness (CWE)

CWE-836: related vulnerabilities

CVEs classified under CWE-836. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

2 published vulnerabilities

• CVE-2026-9222HIGH 8.1

  The Setracker2 Android Companion App version 3.1.5 and earlier contains a critical authentication flaw. Instead of requiring a password during login to backend services, the app accepts only a password hash—the cryptographic fingerprint of the password. An attacker who obtains this hash (through network interception, database breach, or other means) can use it directly to authenticate without knowing the actual password, gaining full access to user accounts and associated data.

• CVE-2026-44736MEDIUM 6.5

  OpenProject, a popular open-source project management platform, contains an information disclosure vulnerability that allows any authenticated user to discover the titles and relationships of work packages they should not be able to see. An attacker with legitimate access to the system can query the relations API endpoint and retrieve sensitive project information by guessing or enumerating work package IDs, circumventing the intended permission controls. This vulnerability was introduced as a side effect of a performance optimization and is resolved in version 17.4.0.