CVE-2026-19748 | Low | 3.7 | 2026-08-13 | A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the f… |
CVE-2026-18531 | Medium | 5.3 | 2026-08-05 | IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret. |
CVE-2026-71225 | Medium | 6.5 | 2026-08-05 | A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cip… |
CVE-2026-66391 | Medium | 6.5 | 2026-07-27 | Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket.
This issue affects Apache Wicket: from 9.0.0 through 9.23.0… |
CVE-2026-46351 | High | 8.1 | 2026-07-16 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference sessionToken values with insufficiently secure randomness in b… |
CVE-2026-47703 | Medium | 5.3 | 2026-07-15 | AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstr… |
CVE-2026-14702 | Low | 2.5 | 2026-07-05 | A flaw has been found in zcaceres markdownify-mcp up to 1.1.0. This impacts the function saveToTempFile of the file src/Markdownify.ts of the component webpage… |
CVE-2026-14570 | High | 7.5 | 2026-07-05 | Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery.
"Crypt::D… |
CVE-2026-57082 | Medium | 5.9 | 2026-06-30 | Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG.
The MSE (Message Stream Encryption)… |
CVE-2026-11374 | Critical | 9.0 | 2026-06-23 | In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be… |
CVE-2026-50009 | Medium | 4.8 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset… |
CVE-2026-45673 | Medium | 6.8 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolve… |
CVE-2026-41701 | Medium | 4.4 | 2026-06-10 | Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected version… |
CVE-2026-41838 | Medium | 4.8 | 2026-06-09 | IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequ… |
CVE-2026-41207 | Medium | 5.3 | 2026-06-04 | The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.21.Final, HKDF_expand returns non-NULL on failure. The byte[] is fi… |
CVE-2026-50208 | Critical | 9.4 | 2026-06-04 | High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM… |
CVE-2026-44054 | Medium | 6.5 | 2026-05-21 | Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attacker to cause a denial… |
CVE-2026-42155 | | | 2026-05-15 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a… |
CVE-2026-41505 | High | 8.7 | 2026-05-07 | RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's make_sign_in_key() functio… |
CVE-2026-7847 | Low | 2.6 | 2026-05-05 | A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-serve… |
CVE-2026-40975 | Medium | 4.8 | 2026-04-28 | Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used f… |
CVE-2026-40496 | Critical | 9.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are generated using a weak and predictable f… |
CVE-2026-40306 | Medium | 6.5 | 2026-04-17 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. All new installations of DNN 10.x.x - 10.2.1 have… |
CVE-2026-33710 | High | 7.5 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, 10000)… |
CVE-2026-34511 | Medium | 5.3 | 2026-04-03 | OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who ca… |
CVE-2024-51346 | High | 7.7 | 2026-03-25 | An issue in Eufy Homebase 2 version 3.3.4.1h allows a local attacker to obtain sensitive information via the cryptographic scheme. |
CVE-2026-25072 | Critical | 9.8 | 2026-03-07 | XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier vulnerability in the /goform/SetLogin endpoint… |
CVE-2026-20101 | High | 8.6 | 2026-03-04 | A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remo… |
CVE-2026-28415 | Medium | 4.3 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accep… |
CVE-2026-27755 | Critical | 9.8 | 2026-02-27 | SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authentica… |
CVE-2026-23999 | Medium | 5.5 | 2026-02-26 | Fleet is open source device management software. In versions prior to 4.80.1, Fleet generated device lock and wipe PINs using a predictable algorithm based sol… |
CVE-2026-27637 | Critical | 9.8 | 2026-02-25 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's `TokenAuth` middleware uses a predicta… |
CVE-2024-48928 | High | 7.5 | 2026-02-24 | Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuration parameter is set… |
CVE-2026-27515 | Critical | 9.1 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 generate predictable numeric session identifiers in the web management interfac… |
CVE-2026-2966 | Low | 3.7 | 2026-02-23 | A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Tr… |
CVE-2025-15574 | Medium | 6.5 | 2026-02-12 | When connecting to the Solax Cloud MQTT server the username is the "registration number", which is the 10 character string printed on the SolaX Power Pocket de… |
CVE-2025-64097 | Critical | 9.8 | 2026-01-22 | NervesHub is a web service that allows users to manage over-the-air (OTA) firmware updates of devices in the field. A vulnerability present starting in version… |
CVE-2025-68704 | High | 7.5 | 2026-01-13 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographical… |
CVE-2025-11723 | Medium | 6.5 | 2026-01-06 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all vers… |
CVE-2026-21444 | Medium | 5.5 | 2026-01-02 | libtpms, a library that provides software emulation of a Trusted Platform Module, has a flaw in versions 0.10.0 and 0.10.1. The commonly used integration of li… |
CVE-2025-11707 | Medium | 5.3 | 2025-12-13 | The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key k… |
CVE-2025-13955 | | | 2025-12-10 | Predictable default Wi-Fi Password in Access Point functionality in EZCast Pro II before version 1.17478.177 allows attackers in Wi-Fi range to gain access to… |
CVE-2025-66511 | Medium | 4.8 | 2025-12-05 | Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function… |
CVE-2025-13353 | Medium | 5.5 | 2025-12-02 | In gokey versions <0.2.0,
a flaw in the seed decryption logic resulted in passwords incorrectly
being derived solely from the initial vector and the AES-GCM… |
CVE-2024-56089 | High | 7.5 | 2025-12-01 | An issue in Technitium through v13.2.2 enables attackers to conduct a DNS cache poisoning attack and inject fake responses by reviving the birthday attack. |
CVE-2025-59371 | | | 2025-11-25 | An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage this vulnerability… |
CVE-2025-13470 | High | 7.5 | 2025-11-21 | In RNP version 0.18.0 a refactoring regression causes the symmetric
session key used for Public-Key Encrypted Session Key (PKESK) packets to
be left uninitia… |
CVE-2025-12787 | Medium | 5.3 | 2025-11-11 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, an… |
CVE-2025-6515 | Medium | 6.8 | 2025-10-20 | The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographically secure. This allows network attacker… |
CVE-2025-10745 | Medium | 5.3 | 2025-09-26 | The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4… |
CVE-2025-10671 | Low | 3.7 | 2025-09-18 | A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. Impacted is the function encryptSecret of the file e-learning-master\exam-api\src\… |
CVE-2025-7783 | | | 2025-07-18 | Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/f… |
CVE-2025-6931 | Low | 3.7 | 2025-06-30 | A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generate_pass_… |
CVE-2025-43866 | High | 7.5 | 2025-06-12 | vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the us… |
CVE-2025-49198 | Low | 3.1 | 2025-06-12 | The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible… |
CVE-2025-4607 | Critical | 9.8 | 2025-05-31 | The PSW Front-end Login & Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12 via the customer_r… |
CVE-2025-5136 | Low | 3.7 | 2025-05-25 | A vulnerability, which was classified as problematic, was found in Tmall Demo up to 20250505. This affects an unknown part of the file /tmall/order/pay/ of the… |
CVE-2025-1953 | Low | 2.6 | 2025-03-04 | A vulnerability has been found in vLLM AIBrix 0.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file pkg/p… |
CVE-2024-50684 | Medium | 6.5 | 2025-02-26 | SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data (insufficient entropy). This may allow attackers to d… |
CVE-2024-10604 | Medium | 5.3 | 2025-01-30 | Vulnerabilities in the algorithms used by Fuchsia to populate network protocol header fields, specifically the TCP ISN, TCP timestamp, TCP and UDP source ports… |
CVE-2025-22150 | Medium | 6.8 | 2025-01-21 | Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for… |
CVE-2025-0218 | Medium | 5.5 | 2025-01-07 | When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficient… |
CVE-2024-12432 | High | 8.1 | 2024-12-18 | The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including… |
CVE-2024-52615 | Medium | 5.3 | 2024-11-21 | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are… |
CVE-2024-10082 | High | 8.7 | 2024-11-06 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
Authentication method confusion allows… |
CVE-2024-20331 | Medium | 6.8 | 2024-10-23 | A vulnerability in the session authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco… |
CVE-2024-47188 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initializ… |
CVE-2024-47187 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initializ… |
CVE-2024-7558 | High | 8.7 | 2024-10-02 | JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the… |
CVE-2024-41708 | High | 7.5 | 2024-09-25 | An issue was discovered in AdaCore ada_web_services 20.0 allows an attacker to escalate privileges and steal sessions via the Random_String() function in the s… |
CVE-2024-6348 | High | 7.5 | 2024-08-19 | Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima (2022) allows attackers to predict… |
CVE-2024-42475 | Medium | 6.5 | 2024-08-15 | In the OAuth library for nim prior to version 0.11, the `state` values generated by the `generateState` function do not have sufficient entropy. These can be s… |
CVE-2024-7659 | Low | 3.7 | 2024-08-12 | A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file include… |
CVE-2024-42165 | Medium | 6.3 | 2024-08-12 | Insufficiently random values for generating activation token in FIWARE Keyrock <= 8.4 allow attackers to activate accounts of any user by predicting the token… |
CVE-2024-42164 | Medium | 4.3 | 2024-08-12 | Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by pr… |
CVE-2024-21460 | High | 7.1 | 2024-07-01 | Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space. |
CVE-2024-25943 | High | 7.6 | 2024-06-29 | iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A r… |
CVE-2024-5868 | Medium | 6.5 | 2024-06-15 | The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficient… |
CVE-2024-35292 | High | 8.2 | 2024-06-11 | A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0) (A… |
CVE-2024-5149 | Medium | 6.5 | 2024-06-05 | The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently ran… |
CVE-2024-36389 | Critical | 9.8 | 2024-06-02 | MileSight DeviceHub -
CWE-330 Use of Insufficiently Random Values may allow Authentication Bypass |
CVE-2024-4185 | High | 8.1 | 2024-04-30 | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification and Authentication Bypass in all versions up to, and i… |
CVE-2023-6799 | Medium | 5.9 | 2024-04-09 | The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2… |
CVE-2024-28013 | Medium | 5.3 | 2024-03-28 | Use of Insufficiently Random Values vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP… |
CVE-2024-1631 | Critical | 9.1 | 2024-02-21 | Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, w… |
CVE-2024-21495 | Medium | 6.5 | 2024-02-17 | Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generatio… |
CVE-2024-0761 | High | 8.1 | 2024-02-05 | The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomnes… |
CVE-2024-23688 | Medium | 5.3 | 2024-01-19 | Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's p… |
CVE-2023-46740 | Medium | 6.5 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, s… |
CVE-2023-32831 | Medium | 5.5 | 2024-01-02 | In wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure with no execution pri… |
CVE-2023-4462 | Low | 3.7 | 2023-12-29 | A vulnerability classified as problematic has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 70… |
CVE-2023-6376 | Medium | 5.3 | 2023-11-30 | Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated att… |
CVE-2023-48056 | High | 7.5 | 2023-11-16 | PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of infor… |
CVE-2020-27636 | Critical | 9.1 | 2023-10-10 | In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random. |
CVE-2020-27635 | Critical | 9.1 | 2023-10-10 | In PicoTCP 1.7.0, TCP ISNs are improperly random. |
CVE-2020-27634 | Critical | 9.1 | 2023-10-10 | In Contiki 4.5, TCP ISNs are improperly random. |
CVE-2020-27633 | Critical | 9.1 | 2023-10-10 | In FNET 4.6.3, TCP ISNs are improperly random. |
CVE-2020-27631 | Critical | 9.8 | 2023-10-10 | In Oryx CycloneTCP 1.9.6, TCP ISNs are improperly random. |
CVE-2020-27630 | Critical | 9.8 | 2023-10-10 | In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random. |
CVE-2020-27213 | High | 7.5 | 2023-10-10 | An issue was discovered in Ethernut Nut/OS 5.1. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficien… |