Håstad's broadcast attack
An attack on RSA where the same message is encrypted with a small public exponent for several recipients, and can be recovered using the Chinese remainder theorem.
Send the same message m to three recipients with exponent e = 3 and different moduli, and an attacker who intercepts all three ciphertexts can combine them with the Chinese remainder theorem. The result is m^3 with no modular reduction, and since m^3 is smaller than the product of the moduli, a plain integer cube root gives m back. Johan Håstad published the general result in the late 1980s.
The fix is randomised padding such as OAEP, so the same message never encrypts to the same ciphertext twice. Anyone running raw RSA with small exponents has traded that security for simplicity, which is rarely a good trade.