CVE WatchOct 23, 2026

CVE-2026-57263

A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores

CVSS

6.8

Medium

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: Aug 11, 2026 · Last modified: Oct 23, 2026 · CWE-759

EPSS · 30d

0.1%EPSS · 30 days0.1%

2026-10-102026-11-07

Technical description

A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allow an attacker who has obtained the project file to perform efficient offline dictionary or brute-force attacks against the unsalted hash.

Official references

cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-751328.html

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-135767.5 HIG

10.0%

——3CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker who obtains the user table can recover passwords by fast offline guessing.2d CVE-2026-965523.1 LOW

14.2%

——4A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without salt. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.45d CVE-2026-62176.3 MED

7.5%

——2Use of a One-Way hash without a salt vulnerability in Pik Online Software Solutions Inc. Pik Online Portal allows Cryptanalysis. This issue affects Pik Online Portal: through 3.5.1.61d CVE-2025-362715.9 MED

11.1%

——3IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.19d CVE-2025-156315.9 MED

23.0%

——7A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.40d CVE-2025-155445.9 MED

28.0%

——8A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related authentication traffic may be able to recover valid credentials and gain unauthorized access to managed devices or controller-managed environments.40d