CVE-2026-11702 | High | 7.5 | 2026-06-26 | Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes.
When an object is initialised before forking, then t… |
CVE-2026-11625 | High | 7.5 | 2026-06-26 | Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.
When an object is initialised before forking, or when the f… |
CVE-2026-41564 | High | 7.5 | 2026-04-23 | CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking.
The Crypt::PK::RSA, Crypt::PK::DSA, Crypt::PK::DH, Crypt::PK::ECC… |
CVE-2026-25835 | High | 7.7 | 2026-04-01 | Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG). |
CVE-2026-3503 | Medium | 5.2 | 2026-03-19 | Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attack… |
CVE-2025-52578 | Medium | 5.7 | 2025-11-18 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access… |
CVE-2025-27580 | High | 7.5 | 2025-04-24 | NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7… |
CVE-2024-10026 | Medium | 5.3 | 2025-01-30 | A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot ident… |
CVE-2025-24783 | High | 7.5 | 2025-01-27 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon.
This issue affects Apache Co… |
CVE-2024-55566 | Medium | 6.6 | 2024-12-09 | ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name derived from an unseeded RNG). The impact can be overwriting fi… |
CVE-2024-9312 | High | 7.5 | 2024-10-10 | Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another u… |
CVE-2024-7558 | High | 8.7 | 2024-10-02 | JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the… |
CVE-2024-36048 | Critical | 9.8 | 2024-05-18 | QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses… |
CVE-2024-1579 | High | 8.1 | 2024-04-29 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue… |
CVE-2024-27632 | High | 8.8 | 2024-04-08 | An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function. |
CVE-2023-4472 | Critical | 9.8 | 2024-02-01 | Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead… |
CVE-2023-49343 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is stored in a locatio… |
CVE-2022-40267 | Medium | 5.9 | 2023-01-20 | Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=… |
CVE-2022-42159 | Medium | 4.3 | 2022-10-13 | D-Link COVR 1200,1202,1203 v1.08 was discovered to have a predictable seed in a Pseudo-Random Number Generator. |
CVE-2022-31008 | Medium | 5.5 | 2022-10-06 | RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (li… |
CVE-2022-39218 | High | 7.5 | 2022-09-20 | The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In ver… |
CVE-2022-31034 | High | 8.3 | 2022-06-27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks… |
CVE-2019-25061 | High | 7.5 | 2022-05-18 | The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature… |
CVE-2022-26852 | High | 8.1 | 2022-04-08 | Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. A remote unauthenticated attacker could potentially… |
CVE-2016-3735 | High | 8.1 | 2022-01-28 | Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset toke… |
CVE-2021-34600 | Medium | 5.5 | 2022-01-20 | Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authori… |
CVE-2021-42810 | High | 7.8 | 2022-01-19 | A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent… |
CVE-2021-41117 | High | 8.7 | 2021-10-11 | keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other librarie… |
CVE-2021-32033 | Medium | 4.6 | 2021-06-16 | Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations. The time value used by… |
CVE-2020-28597 | High | 7.5 | 2021-03-03 | A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate th… |
CVE-2021-27211 | High | 7.5 | 2021-02-15 | steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data. |
CVE-2020-7010 | High | 7.5 | 2020-06-03 | Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the… |
CVE-2020-13784 | High | 7.5 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator. |
CVE-2012-1577 | Critical | 9.8 | 2019-12-10 | lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0. |
CVE-2019-11495 | Critical | 9.8 | 2019-09-10 | In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now() to seed the PRNG which r… |
CVE-2018-12384 | Medium | 5.9 | 2019-04-29 | When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full… |
CVE-2019-10908 | Critical | 9.8 | 2019-04-07 | In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG… |
CVE-2018-14647 | High | 7.5 | 2018-09-25 | Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks a… |
CVE-2018-12520 | High | 8.1 | 2018-07-05 | An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in d… |
CVE-2018-1426 | High | 7.4 | 2018-03-22 | IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple ICC instances are… |
CVE-2017-11519 | Critical | 9.8 | 2017-07-21 | passwd_recovery.lua on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin password by leveraging a predictable random number generator s… |
CVE-2017-5214 | High | 7.5 | 2017-05-17 | The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows prediction of a uniqid value based on knowledge of a time value. This m… |
CVE-2016-10180 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding. |