CVE-2026-59776
Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is expl
CVSS
6.8
Medium
EPSS
0.2%
p6
KEV
—
Exploit Today
2
0-100
Published: Jul 21, 2026 · Last modified: Jul 21, 2026 · CWE-325
0.1%EPSS · 30 days0.2%
2026-08-282026-09-25
Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is exploited, information stored in the IC chip may be read or tampered with.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-965523.1 LOW3.5%
——1A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without salt. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.1dCVE-2026-812358.0 HIG13.5%
——4Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cryptographic Step vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.4dCVE-2026-252506.0 MED4.3%
——1EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable."16dCVE-2026-76784—8.4%
——3Multiple
TP-Link Kasa smart home devices contain insufficient cryptographic protections
in the local device communication protocol. An adjacent network attacker may
intercept, replay or forge locally exchanged control messages, potentially
resulting in unauthorized device control.
Successful
exploitation could allow an attacker to manipulate the operational state of an
affected device, resulting in unauthorized state changes, disruption of normal
device functionality or a denial-of-service condition.28dCVE-2026-176669.1 CRI6.0%
——2Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discretionary access control via malicious network traffic. (Chromium security severity: High)54dCVE-2026-586386.0 MED12.9%
——4Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a security feature locally.65d