CVE-2023-46233Critical· 9.1▾ Midnightcrypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.
crypto-js < 4.2.0Upgrade past the affected range:
crypto-js 4.2.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-71851Critical· 9.0crypto-js is a JavaScript library of crypto standards
CVE-2023-0567High· 7.7In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid
CVE-2026-14630Low· 3.1A vulnerability has been found in ForceInjection AI-fundermentals 2.0/3.0
CVE-2026-13510Low· 3.7A vulnerability was found in SimStudioAI sim up to 0.6.92
CVE-2025-36084Medium· 5.9Multiple Vulnerabilities in IBM Concert Software
CVE-2026-53762Medium· 6.2VeraCrypt provides disk encryption with strong security based on TrueCrypt