CWE-323

CWE-323 · 4 records · 2 with a public proof-of-concept

Records the NVD classes under CWE-323, highest CVSS first.

  1. HIGH 8.4CVE-2026-1091402026-11-02

    The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.

    AI risk analysis on Exploit-DB.ai →

  2. MEDIUM 5.3CVE-2026-15890public PoC2026-09-21

    The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead_get_nonce() in subsys/secure_storage/src/its/transform/aead_get.c, stores its nonce counter in unsynchronized function-local static variabl…

    AI risk analysis on Exploit-DB.ai →

  3. UNSCOREDCVE-2026-71884public PoC2026-10-09

    In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IV left. In CTR mode the IV and the block counter share one 16-byte block, so an IV of 13 to 15 bytes…

    AI risk analysis on Exploit-DB.ai →

  4. UNSCOREDCVE-2026-175782026-08-05

    Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends …

    AI risk analysis on Exploit-DB.ai →