CVE-2026-65309
ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-
CVSS
7.5
High
EPSS
0.2%
p15
KEV
—
Exploit Today
4
0-100
Published: Jul 31, 2026 · Last modified: Aug 28, 2026 · CWE-257 · CWE-327
0.2%EPSS · 30 days0.2%
2026-09-212026-10-19
ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-31615.9 MED—
——0IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.1dCVE-2026-69303.7 LOW—
——0IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.1dCVE-2026-591166.8 MED28.8%
——9Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over a network.7dCVE-2026-287457.5 HIG11.4%
——3Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.9dCVE-2026-103548—0.6%
——0Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.19dCVE-2026-1028244.3 MED3.1%
——1Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret, forcing the X25519 contribution to the combined shared secret to zero. A malicious SSH peer can therefore make the combined secret depend only on ML-KEM, defeating the hybrid exchange's intended fallback protection if ML-KEM is later weakened. This issue is fixed in version 0.63.0.21d