CVE-2026-57263
A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores
CVSS
6.8
Medio
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Publicado: 11 ago 2026 · Última mod.: 23 oct 2026 · CWE-759
0.1%EPSS · 30 días0.1%
2026-10-102026-11-07
A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allow an attacker who has obtained the project file to perform efficient offline dictionary or brute-force attacks against the unsalted hash.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-135767.5 ALT10.0%
——3CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.
Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.
An attacker who obtains the user table can recover passwords by fast offline guessing.2dCVE-2026-965523.1 BAJ14.2%
——4A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without salt. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.45dCVE-2026-62176.3 MED7.5%
——2Use of a One-Way hash without a salt vulnerability in Pik Online Software Solutions Inc. Pik Online Portal allows Cryptanalysis.
This issue affects Pik Online Portal: through 3.5.1.61dCVE-2025-362715.9 MED11.1%
——3IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.19dCVE-2025-156315.9 MED23.0%
——7A
cryptographic weakness exists in affected Omada devices where site credentials
are protected using a legacy hashing algorithm that does not provide sufficient
protection.
An attacker
who obtains access to stored credential data may be able to recover valid credentials
to gain unauthorized access to affected devices or management environments.40dCVE-2025-155445.9 MED28.0%
——8A cryptographic
weakness exists in the Omada device adoption process. During adoption, authentication credentials associated
with site management are transmitted using a weak hashing algorithm that does
not provide sufficient protection.
An attacker who
successfully intercepts adoption-related authentication traffic may be able to
recover valid credentials and gain unauthorized access to managed devices or
controller-managed environments.40d