By weakness (CWE)

CWE-916: related vulnerabilities

CVEs classified under CWE-916. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

6 published vulnerabilities

• CVE-2026-55069HIGH 8.7

  Kestra is an open-source workflow orchestration platform used to automate complex business processes. A vulnerability in versions prior to 1.3.24 allows attackers with database access to recover administrator credentials through offline password cracking. This is particularly dangerous in Kubernetes environments, where a compromised admin account can be leveraged to steal cluster tokens and secrets, granting access to the entire Kubernetes cluster and its workloads.

• CVE-2026-40522HIGH 7.1

  FrontAccounting versions before 2.4.20 contain a SQL injection flaw in the Bank Statement report feature. An authenticated user can craft malicious SQL code in the report parameters to bypass normal database queries and extract sensitive information such as usernames, password hashes, and email addresses from the system. The vulnerability allows this data to be embedded into PDF reports. Because the flaw requires user login credentials to exploit, it represents a risk primarily from insiders or compromised accounts rather than unauthenticated internet attacks.

• CVE-2026-25861MEDIUM 5.9

  QloApps versions through 1.7.0 use MD5 to hash passwords, a cryptographic method that is computationally cheap to crack. The vulnerability is particularly severe because QloApps concatenates a static value (a cookie key) with user passwords before hashing, reducing the effective randomness of the hash. When guest accounts are automatically converted to customer accounts, the system assigns simple 8-character passwords, which are trivially recoverable through offline brute-force attacks. An attacker who gains access to the password database can extract user credentials without needing to interact with the application in real time.

• CVE-2026-44611MEDIUM 5.4

  Danelec MacGregor's Voyage Data Recorder (VDR) uses a weak password hashing method that restricts password length and is vulnerable to brute force attacks. An authenticated attacker with local network access could potentially crack stored passwords to gain unauthorized access to the device or escalate privileges. This is a medium-severity issue affecting maritime safety and navigation systems.

• CVE-2026-9641MEDIUM 5.3

  Crypt::PBKDF2, a Perl cryptographic library, uses cryptographic settings that are too weak by modern standards in versions before 0.261630. Specifically, the library defaults to HMAC-SHA1 (an older algorithm suitable only for legacy compatibility) and performs only 1,000 iterations of the key derivation process. Modern best practices recommend 220,000 to 1,400,000 iterations depending on the algorithm chosen. This gap between defaults and best practices weakens password protection for applications that rely on these defaults without customization.

• CVE-2026-56272MEDIUM 4.1

  Flowise versions before 3.0.13 use weak password hashing configuration that makes user account credentials significantly easier to crack if a database is compromised. The application relies on bcrypt with only 5 salt rounds (32 iterations), whereas security best practices call for at least 10 rounds. This 30x speed advantage in cracking attempts means attackers with GPU hardware can recover plaintext passwords from stolen hashes much faster than intended.