Loading story…
OWASP’s Top 10 2025 category A04: Cryptographic Failures emphasizes that many security weaknesses tied to cryptography stem from implementation mistakes rather than broken cryptographic primitives. Supporting analysis from Semgrep says the most common patterns in GitHub Security Advisories mapped to A04:2025 involve improper signature verification (CWE-347) and use of risky or obsolete algorithms (CWE-327), with failures often occurring in the validation logic surrounding attacker-controlled inputs.
One cited example, CVE-2021-43572, showed how an implementation could accept an invalid ECDSA signature with r=0 and s=0 because the code did not enforce required value ranges, allowing signature verification to be bypassed. The reporting underscores that organizations should treat cryptographic risk as a software assurance problem as much as a mathematics problem, prioritizing code review and testing for input validation, signature checks, and algorithm selection in applications that rely on encryption or digital signatures.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
Semgrep published an analysis arguing that many cryptographic vulnerabilities stem from surrounding application code rather than broken cryptography, highlighting CWE-347 and CWE-327 patterns from GitHub Security Advisories mapped to OWASP A04:2025.
OWASP published its Top 10:2025 category A04, Cryptographic Failures, framing weaknesses in cryptographic implementation and use as a major application security risk category.
CVE-2021-43572 was disclosed as a cryptographic implementation flaw in which an attacker could provide an ECDSA signature with r=0 and s=0 to bypass verification because the code failed to enforce valid parameter ranges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MITRE’s 2025 CWE Top 25 Most Dangerous Software Weaknesses report reveals that foundational coding errors, such as cross-site scripting and SQL injection, continue to be the primary causes of real-world breaches. Despite advancements in security tools, DevSecOps practices, and increased awareness, the same core weaknesses are repeatedly exploited, underscoring a systemic failure to address root causes in software development. The report emphasizes that organizations focusing solely on patching individual CVEs without addressing underlying CWEs remain vulnerable to recurring threats, as these weaknesses represent the fundamental flaws attackers leverage most frequently. Vulnerability databases play a critical role in cataloging known software vulnerabilities, but they are not comprehensive and often suffer from delayed updates and incomplete coverage. Transparency in vulnerability disclosure is essential for trust, yet many vulnerabilities remain unregistered due to complex reporting processes and disincentives for public disclosure. Security professionals are advised to use vulnerability databases as one tool among many, recognizing their limitations and the importance of proactive security testing and defense-in-depth strategies to mitigate risks from persistent software weaknesses.
Jul 12, 2026
CISA’s vulnerability review of fiscal years 2024–2025 found that damaging compromises predominantly resulted from opportunistic exploitation of known, internet-exposed vulnerabilities and fundamental security failures—not zero-days or highly sophisticated campaigns. The affected weaknesses frequently involved memory safety, injection, and improper input validation; **41.5%** of known exploited vulnerabilities mapped to persistent MITRE CWE Top 25 weakness classes. CISA reported widespread risk from vulnerable exposed services, unsupported software, and deprecated SSL/TLS, and warned that CVSS scores alone are insufficient for remediation decisions. Its Binding Operational Directive 26-04 prioritization framework weighs internet exposure, Known Exploited Vulnerabilities Catalog status, likelihood of automated exploitation, and technical impact; recommended actions include rapidly remediating exposed KEVs, retiring end-of-support systems, strengthening input validation, and adopting Secure by Design practices such as memory-safe languages and SBOMs.
Aug 28, 2026
MITRE, in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA) and the Homeland Security Systems Engineering and Development Institute (HSSEDI), has published the 2025 list of the Top 25 Most Dangerous Software Weaknesses. This annual ranking is based on the analysis of over 39,000 CVE records from June 2024 to June 2025, scoring each weakness by severity and frequency. The list highlights critical software flaws such as Cross-Site Scripting (CWE-79), SQL Injection (CWE-89), and Cross-Site Request Forgery (CWE-352), with notable changes in rankings and several new entries including various buffer overflows and improper access control issues. CISA emphasizes the importance of this list for organizations aiming to reduce vulnerabilities, improve cost efficiency by addressing weaknesses early in the software lifecycle, and strengthen trust through Secure by Design principles. The Top 25 serves as a guide for developers, product teams, and consumers to prioritize mitigation efforts, make informed purchasing decisions, and adopt secure engineering practices to protect against the most commonly exploited software weaknesses.
Jun 29, 2026