CVE-2026-96599 | Medium | 5.9 | 2026-09-23 | Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to gu… |
CVE-2026-92930 | Medium | 6.2 | 2026-09-23 | OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other se… |
CVE-2026-94456 | Critical | 9.1 | 2026-09-22 | Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access to… |
CVE-2026-80154 | Critical | 9.6 | 2026-09-22 | All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web m… |
CVE-2026-92913 | High | 7.4 | 2026-09-17 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation /… |
CVE-2026-92912 | Medium | 6.5 | 2026-09-17 | AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entr… |
CVE-2026-19407 | | | 2026-09-15 | Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution… |
CVE-2026-84606 | High | 7.5 | 2026-09-14 | A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may… |
CVE-2026-53939 | Critical | 9.1 | 2026-09-09 | OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE usi… |
CVE-2026-79575 | High | 7.5 | 2026-09-08 | The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily… |
CVE-2026-86187 | Medium | 5.9 | 2026-09-05 | WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with a… |
CVE-2026-17274 | Medium | 5.4 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds. |
CVE-2026-3416 | Medium | 5.9 | 2026-09-03 | The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This… |
CVE-2026-66047 | High | 8.1 | 2026-08-31 | ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attack… |
CVE-2026-81852 | | | 2026-08-31 | Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-… |
CVE-2026-82555 | Low | 3.7 | 2026-08-30 | A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function loginAuth of the file /web_cste/cgi-bin/cstecg… |
CVE-2026-19485 | | | 2026-08-26 | A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud… |
CVE-2026-62862 | | | 2026-08-25 | Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vuln… |
CVE-2026-56706 | Medium | 6.8 | 2026-08-25 | Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token (format (rand XOR secret):rand), allowing an… |
CVE-2026-27490 | High | 7.5 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 2… |
CVE-2026-19906 | Low | 3.7 | 2026-08-15 | A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.p… |
CVE-2026-19896 | Low | 3.7 | 2026-08-15 | A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build_secret_key of the file dtale/app.py of the component Flask… |
CVE-2026-19748 | Low | 3.7 | 2026-08-13 | A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the f… |
CVE-2026-18531 | Medium | 5.3 | 2026-08-05 | IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret. |
CVE-2026-71225 | Medium | 6.5 | 2026-08-05 | A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cip… |
CVE-2026-66391 | Medium | 6.5 | 2026-07-27 | Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket.
This issue affects Apache Wicket: from 9.0.0 through 9.23.0… |
CVE-2026-46351 | High | 8.1 | 2026-07-16 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference sessionToken values with insufficiently secure randomness in b… |
CVE-2026-47703 | Medium | 5.3 | 2026-07-15 | AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstr… |
CVE-2026-14702 | Low | 2.5 | 2026-07-05 | A flaw has been found in zcaceres markdownify-mcp up to 1.1.0. This impacts the function saveToTempFile of the file src/Markdownify.ts of the component webpage… |
CVE-2026-14570 | High | 7.5 | 2026-07-05 | Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery.
"Crypt::D… |
CVE-2026-57082 | Medium | 5.9 | 2026-06-30 | Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG.
The MSE (Message Stream Encryption)… |
CVE-2026-11374 | Critical | 9.0 | 2026-06-23 | In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be… |
CVE-2026-50009 | Medium | 4.8 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset… |
CVE-2026-45673 | Medium | 6.8 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolve… |
CVE-2026-41701 | Medium | 4.4 | 2026-06-10 | Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected version… |
CVE-2026-41838 | Medium | 4.8 | 2026-06-09 | IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequ… |
CVE-2026-41207 | Medium | 5.3 | 2026-06-04 | The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.21.Final, HKDF_expand returns non-NULL on failure. The byte[] is fi… |
CVE-2026-50208 | Critical | 9.4 | 2026-06-04 | High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM… |
CVE-2026-44054 | Medium | 6.5 | 2026-05-21 | Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attacker to cause a denial… |
CVE-2026-42155 | | | 2026-05-15 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a… |
CVE-2026-41505 | High | 8.7 | 2026-05-07 | RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's make_sign_in_key() functio… |
CVE-2026-7847 | Low | 2.6 | 2026-05-05 | A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-serve… |
CVE-2026-40975 | Medium | 4.8 | 2026-04-28 | Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used f… |
CVE-2026-40496 | Critical | 9.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are generated using a weak and predictable f… |
CVE-2026-40306 | Medium | 6.5 | 2026-04-17 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. All new installations of DNN 10.x.x - 10.2.1 have… |
CVE-2026-33710 | High | 7.5 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, 10000)… |
CVE-2026-34511 | Medium | 5.3 | 2026-04-03 | OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who ca… |
CVE-2024-51346 | High | 7.7 | 2026-03-25 | An issue in Eufy Homebase 2 version 3.3.4.1h allows a local attacker to obtain sensitive information via the cryptographic scheme. |
CVE-2026-25072 | Critical | 9.8 | 2026-03-07 | XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier vulnerability in the /goform/SetLogin endpoint… |
CVE-2026-20101 | High | 8.6 | 2026-03-04 | A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remo… |
CVE-2026-28415 | Medium | 4.3 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accep… |
CVE-2026-27755 | Critical | 9.8 | 2026-02-27 | SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authentica… |
CVE-2026-23999 | Medium | 5.5 | 2026-02-26 | Fleet is open source device management software. In versions prior to 4.80.1, Fleet generated device lock and wipe PINs using a predictable algorithm based sol… |
CVE-2026-27637 | Critical | 9.8 | 2026-02-25 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's `TokenAuth` middleware uses a predicta… |
CVE-2024-48928 | High | 7.5 | 2026-02-24 | Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuration parameter is set… |
CVE-2026-27515 | Critical | 9.1 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 generate predictable numeric session identifiers in the web management interfac… |
CVE-2026-2966 | Low | 3.7 | 2026-02-23 | A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Tr… |
CVE-2025-15574 | Medium | 6.5 | 2026-02-12 | When connecting to the Solax Cloud MQTT server the username is the "registration number", which is the 10 character string printed on the SolaX Power Pocket de… |
CVE-2025-64097 | Critical | 9.8 | 2026-01-22 | NervesHub is a web service that allows users to manage over-the-air (OTA) firmware updates of devices in the field. A vulnerability present starting in version… |
CVE-2025-68704 | High | 7.5 | 2026-01-13 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographical… |
CVE-2025-11723 | Medium | 6.5 | 2026-01-06 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all vers… |
CVE-2026-21444 | Medium | 5.5 | 2026-01-02 | libtpms, a library that provides software emulation of a Trusted Platform Module, has a flaw in versions 0.10.0 and 0.10.1. The commonly used integration of li… |
CVE-2025-11707 | Medium | 5.3 | 2025-12-13 | The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key k… |
CVE-2025-13955 | | | 2025-12-10 | Predictable default Wi-Fi Password in Access Point functionality in EZCast Pro II before version 1.17478.177 allows attackers in Wi-Fi range to gain access to… |
CVE-2025-66511 | Medium | 4.8 | 2025-12-05 | Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function… |
CVE-2025-13353 | Medium | 5.5 | 2025-12-02 | In gokey versions <0.2.0,
a flaw in the seed decryption logic resulted in passwords incorrectly
being derived solely from the initial vector and the AES-GCM… |
CVE-2024-56089 | High | 7.5 | 2025-12-01 | An issue in Technitium through v13.2.2 enables attackers to conduct a DNS cache poisoning attack and inject fake responses by reviving the birthday attack. |
CVE-2025-59371 | | | 2025-11-25 | An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage this vulnerability… |
CVE-2025-13470 | High | 7.5 | 2025-11-21 | In RNP version 0.18.0 a refactoring regression causes the symmetric
session key used for Public-Key Encrypted Session Key (PKESK) packets to
be left uninitia… |
CVE-2025-12787 | Medium | 5.3 | 2025-11-11 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, an… |
CVE-2025-6515 | Medium | 6.8 | 2025-10-20 | The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographically secure. This allows network attacker… |
CVE-2025-10745 | Medium | 5.3 | 2025-09-26 | The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4… |
CVE-2025-10671 | Low | 3.7 | 2025-09-18 | A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. Impacted is the function encryptSecret of the file e-learning-master\exam-api\src\… |
CVE-2025-7783 | | | 2025-07-18 | Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/f… |
CVE-2025-6931 | Low | 3.7 | 2025-06-30 | A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generate_pass_… |
CVE-2025-43866 | High | 7.5 | 2025-06-12 | vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the us… |
CVE-2025-49198 | Low | 3.1 | 2025-06-12 | The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible… |
CVE-2025-4607 | Critical | 9.8 | 2025-05-31 | The PSW Front-end Login & Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12 via the customer_r… |
CVE-2025-5136 | Low | 3.7 | 2025-05-25 | A vulnerability, which was classified as problematic, was found in Tmall Demo up to 20250505. This affects an unknown part of the file /tmall/order/pay/ of the… |
CVE-2025-1953 | Low | 2.6 | 2025-03-04 | A vulnerability has been found in vLLM AIBrix 0.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file pkg/p… |
CVE-2024-50684 | Medium | 6.5 | 2025-02-26 | SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data (insufficient entropy). This may allow attackers to d… |
CVE-2024-10604 | Medium | 5.3 | 2025-01-30 | Vulnerabilities in the algorithms used by Fuchsia to populate network protocol header fields, specifically the TCP ISN, TCP timestamp, TCP and UDP source ports… |
CVE-2025-22150 | Medium | 6.8 | 2025-01-21 | Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for… |
CVE-2025-0218 | Medium | 5.5 | 2025-01-07 | When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficient… |
CVE-2024-12432 | High | 8.1 | 2024-12-18 | The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including… |
CVE-2024-52615 | Medium | 5.3 | 2024-11-21 | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are… |
CVE-2024-10082 | High | 8.7 | 2024-11-06 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
Authentication method confusion allows… |
CVE-2024-20331 | Medium | 6.8 | 2024-10-23 | A vulnerability in the session authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco… |
CVE-2024-47188 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initializ… |
CVE-2024-47187 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initializ… |
CVE-2024-7558 | High | 8.7 | 2024-10-02 | JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the… |
CVE-2024-41708 | High | 7.5 | 2024-09-25 | An issue was discovered in AdaCore ada_web_services 20.0 allows an attacker to escalate privileges and steal sessions via the Random_String() function in the s… |
CVE-2024-6348 | High | 7.5 | 2024-08-19 | Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima (2022) allows attackers to predict… |
CVE-2024-42475 | Medium | 6.5 | 2024-08-15 | In the OAuth library for nim prior to version 0.11, the `state` values generated by the `generateState` function do not have sufficient entropy. These can be s… |
CVE-2024-7659 | Low | 3.7 | 2024-08-12 | A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file include… |
CVE-2024-42165 | Medium | 6.3 | 2024-08-12 | Insufficiently random values for generating activation token in FIWARE Keyrock <= 8.4 allow attackers to activate accounts of any user by predicting the token… |
CVE-2024-42164 | Medium | 4.3 | 2024-08-12 | Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by pr… |
CVE-2024-21460 | High | 7.1 | 2024-07-01 | Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space. |
CVE-2024-25943 | High | 7.6 | 2024-06-29 | iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A r… |
CVE-2024-5868 | Medium | 6.5 | 2024-06-15 | The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficient… |