CVE-2026-19748 | Low | 3.7 | 2026-08-13 | A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the f… |
CVE-2026-71851 | Critical | 9.0 | 2026-08-07 | crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a cust… |
CVE-2026-38447 | Critical | 9.8 | 2026-08-03 | osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current… |
CVE-2025-15629 | High | 7.5 | 2026-08-03 | A cryptographic
weakness exists in the Omada adoption protocol where session encryption keys
used to protect communications between controllers and managed dev… |
CVE-2026-4932 | Medium | 4.2 | 2026-07-28 | IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Transparent Memory Encr… |
CVE-2026-11403 | | | 2026-07-14 | A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository… |
CVE-2026-13199 | Medium | 4.0 | 2026-07-07 | EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent kernel addresses acro… |
CVE-2026-4930 | | | 2026-06-25 | SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptographic operations (AES encryption/decrypt… |
CVE-2026-46473 | High | 7.5 | 2026-05-21 | Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand.
Secrets were generated using Perl's built-in rand function, which is predictable and… |
CVE-2026-8700 | High | 7.3 | 2026-05-15 | Crypt::DSA versions before 1.20 for Perl generate seeds using rand.
Seeds were generated using Perl's built-in rand function, which is predictable and unsuita… |
CVE-2026-46474 | High | 7.5 | 2026-05-15 | Trog::TOTP versions before 1.006 for Perl generate secrets using rand.
Secrets were generated using Perl's built-in rand function, which is predictable and un… |
CVE-2026-42155 | | | 2026-05-15 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a… |
CVE-2025-14972 | | | 2026-05-15 | * Countermeasures for DPA within SYMCRYPTO
engine on SixG301xxx devices are not sufficiently random and will
eventually repeat.
* KSU keys using SYMCRYPTO… |
CVE-2026-4827 | | | 2026-05-12 | CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑man… |
CVE-2026-7210 | High | 7.5 | 2026-05-11 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger has… |
CVE-2026-2336 | High | 8.8 | 2026-04-16 | A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own… |
CVE-2026-41080 | Low | 2.9 | 2026-04-16 | libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. |
CVE-2026-34236 | High | 8.2 | 2026-04-01 | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK… |
CVE-2026-2878 | Medium | 5.3 | 2026-02-25 | In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary… |
CVE-2025-0577 | Medium | 4.8 | 2026-02-18 | An insufficient entropy vulnerability was found in glibc. The getrandom and arc4random family of functions may return predictable randomness if these functions… |
CVE-2026-2541 | | | 2026-02-15 | The Micca KE700 system relies on a 6-bit portion of an identifier for authentication within rolling codes, providing only 64 possible combinations. This low en… |
CVE-2025-7432 | | | 2026-02-09 | DPA countermeasures in Silicon Labs' Series 2 devices are not reseeded under certain conditions.
This may allow an attacker to eventually extract secret keys… |
CVE-2026-1814 | | | 2026-02-03 | Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. Wh… |
CVE-2025-13399 | High | 8.8 | 2026-01-29 | A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercept… |
CVE-2026-22698 | High | 7.5 | 2026-01-10 | RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve fo… |
CVE-2020-36925 | Critical | 9.8 | 2026-01-06 | Arteco Web Client DVR/NVR contains a session hijacking vulnerability with insufficient session ID complexity that allows remote attackers to bypass authenticat… |
CVE-2025-15387 | High | 8.8 | 2025-12-31 | VPN Firewall developed by QNO Technology has a Insufficient Entropy vulnerability, allowing unauthenticated remote attackers to obtain any logged-in user sessi… |
CVE-2025-67504 | Critical | 9.1 | 2025-12-09 | WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not c… |
CVE-2025-66565 | Critical | 9.8 | 2025-12-09 | Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (c… |
CVE-2025-14261 | High | 7.1 | 2025-12-08 | The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes… |
CVE-2025-32898 | Medium | 4.7 | 2025-12-05 | The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1… |
CVE-2025-62774 | Low | 3.1 | 2025-10-22 | On Mercku M6a devices through 2.1.0, the authentication system uses predictable session tokens based on timestamps. |
CVE-2024-58040 | Critical | 9.1 | 2025-09-30 | Crypt::RandomEncryption for Perl version 0.01 uses insecure rand() function during encryption. |
CVE-2025-59015 | Medium | 6.5 | 2025-09-09 | A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing a… |
CVE-2025-54885 | | | 2025-08-07 | Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol… |
CVE-2025-50122 | | | 2025-07-11 | A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the
password generation algorithm is reverse engineered with… |
CVE-2025-6931 | Low | 3.7 | 2025-06-30 | A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generate_pass_… |
CVE-2025-52464 | High | 8.3 | 2025-06-19 | Meshtastic is an open source mesh networking solution. In versions from 2.5.0 to before 2.6.11, the flashing procedure of several hardware vendors was resultin… |
CVE-2025-47781 | Critical | 9.8 | 2025-05-14 | Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based authentication. When a… |
CVE-2024-58134 | High | 8.1 | 2025-05-03 | Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.
These pred… |
CVE-2025-2814 | Medium | 4.0 | 2025-04-13 | Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cry… |
CVE-2024-56370 | Medium | 6.5 | 2025-04-05 | Net::Xero 0.044 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functi… |
CVE-2024-52322 | Medium | 5.5 | 2025-04-05 | WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic… |
CVE-2024-58036 | Medium | 5.5 | 2025-04-05 | Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic… |
CVE-2024-57868 | Medium | 5.5 | 2025-04-05 | Web::API 2.8 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions… |
CVE-2025-1860 | High | 7.7 | 2025-03-28 | Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic fun… |
CVE-2025-27552 | Medium | 4.0 | 2025-03-26 | DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.
This vulnerability is associated with progr… |
CVE-2025-27551 | Medium | 4.0 | 2025-03-26 | DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.
This vulnerability is associated with progr… |
CVE-2025-29311 | High | 7.5 | 2025-03-24 | Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack. Attackers are able to leverage thi… |
CVE-2024-9055 | Medium | 4.2 | 2025-03-17 | The DPA countermeasures on Silicon Labs' Series 2 devices are not reseeded periodically as they should be. This may allow an attacker to eventually extract sec… |
CVE-2025-1828 | High | 8.8 | 2025-03-11 | Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions.
If the Provider is n… |
CVE-2024-53522 | High | 7.5 | 2025-01-07 | Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components. This allo… |
CVE-2018-9426 | High | 7.5 | 2024-12-02 | In RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java, an incorrect implementation could cause weak RSA key pairs being generated. This co… |
CVE-2024-20331 | Medium | 6.8 | 2024-10-23 | A vulnerability in the session authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco… |
CVE-2024-47945 | Critical | 9.8 | 2024-10-15 | The devices are vulnerable to session hijacking due to insufficient
entropy in its session ID generation algorithm. The session IDs are
predictable, with onl… |
CVE-2023-37822 | High | 8.2 | 2024-10-03 | The Eufy Homebase 2 before firmware version 3.3.4.1h creates a dedicated wireless network for its ecosystem, which serves as a proxy to the end user's primary… |
CVE-2024-8796 | Medium | 5.3 | 2024-09-17 | Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum de… |
CVE-2024-38270 | Medium | 5.3 | 2024-09-10 | An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in t… |
CVE-2024-6508 | High | 8.0 | 2024-08-21 | An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulner… |
CVE-2023-49927 | Medium | 5.3 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, E… |
CVE-2024-36400 | Critical | 9.4 | 2024-06-04 | nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_i… |
CVE-2024-3411 | Critical | 9.1 | 2024-04-30 | Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predict… |
CVE-2024-26329 | Medium | 6.2 | 2024-04-05 | Chilkat before v9.5.0.98, allows attackers to obtain sensitive information via predictable PRNG in ChilkatRand::randomBytes function. |
CVE-2024-25730 | Critical | 9.8 | 2024-02-23 | Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, resulting in insuff… |
CVE-2024-22473 | Medium | 6.8 | 2024-02-21 | TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing… |
CVE-2024-25407 | High | 7.5 | 2024-02-13 | SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. This vulnerability can allow attackers to cause a De… |
CVE-2023-49599 | Critical | 9.8 | 2024-01-10 | An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HT… |
CVE-2023-46648 | High | 8.3 | 2023-12-21 | An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES M… |
CVE-2023-26154 | Medium | 5.9 | 2023-12-06 | Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the p… |
CVE-2023-31176 | High | 7.5 | 2023-11-30 | An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session… |
CVE-2023-31582 | High | 7.5 | 2023-10-25 | jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less. |
CVE-2023-34973 | Low | 3.1 | 2023-08-24 | An insufficient entropy vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to predi… |
CVE-2023-4344 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection |
CVE-2023-38357 | Medium | 5.3 | 2023-08-01 | Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions. |
CVE-2023-36610 | Medium | 5.9 | 2023-07-03 |
The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized… |
CVE-2023-3325 | High | 8.1 | 2023-06-20 | The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_ad… |
CVE-2020-36732 | Medium | 5.3 | 2023-06-12 | The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictab… |
CVE-2023-20107 | High | 7.5 | 2023-03-23 | A vulnerability in the deterministic random bit generator (DRBG), also known as pseudorandom number generator (PRNG), in Cisco Adaptive Security Appliance (ASA… |
CVE-2022-43755 | High | 7.1 | 2023-02-07 | A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token w… |
CVE-2021-4238 | Critical | 9.1 | 2022-12-27 | Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always… |
CVE-2021-4241 | Low | 2.6 | 2022-11-15 | A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php… |
CVE-2021-4240 | Low | 2.6 | 2022-11-15 | A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the file src/psm/Servi… |
CVE-2022-20941 | Medium | 5.3 | 2022-11-15 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to ac… |
CVE-2022-34746 | Medium | 5.9 | 2022-09-20 | An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 s… |
CVE-2022-33989 | Medium | 5.3 | 2022-08-15 | dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream queries sent to DNS resolvers. This allows DN… |
CVE-2022-34294 | Critical | 9.8 | 2022-08-15 | totd 1.5.3 uses a fixed UDP source port in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to preve… |
CVE-2022-37401 | High | 8.8 | 2022-08-15 | Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single… |
CVE-2021-41615 | Critical | 9.8 | 2022-08-08 | websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which d… |
CVE-2020-29508 | Medium | 5.3 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Improper Input Validation Vulnera… |
CVE-2020-29505 | High | 7.1 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Key Management Error Vulnerabili… |
CVE-2022-33738 | High | 7.5 | 2022-07-06 | OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal |
CVE-2022-31034 | High | 8.3 | 2022-06-27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks… |
CVE-2022-33756 | High | 7.5 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an entropy weakness vulnerability in the Automic AutomationEngine that could allow a remote attacker to potentially… |
CVE-2021-22799 | Low | 3.8 | 2022-01-28 | A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network when an attacker ma… |
CVE-2021-36294 | Critical | 9.8 | 2022-01-25 | Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker may exploit this vulne… |
CVE-2021-42138 | High | 7.2 | 2021-12-20 | A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that… |
CVE-2021-36320 | High | 7.5 | 2021-11-20 | Dell Networking X-Series firmware versions prior to 3.0.1.8 contain an authentication bypass vulnerability. A remote unauthenticated attacker may potentially h… |
CVE-2021-31798 | Medium | 4.4 | 2021-09-02 | The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain conditions a local malicious… |
CVE-2021-31797 | Medium | 5.1 | 2021-09-02 | The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition, leading to password disclos… |
CVE-2020-25926 | High | 7.5 | 2021-08-18 | The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning (remote… |