CVE-2026-73567 | Critical | 9.1 | 2026-08-13 | sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKe… |
CVE-2026-18611 | High | 7.5 | 2026-08-10 | A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB… |
CVE-2026-71851 | Critical | 9.0 | 2026-08-07 | crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a cust… |
CVE-2026-9205 | High | 7.4 | 2026-08-05 | IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function. |
CVE-2026-47882 | High | 8.3 | 2026-07-30 | When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Das… |
CVE-2026-64798 | Critical | 9.1 | 2026-07-22 | Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic ra… |
CVE-2026-16615 | Medium | 6.8 | 2026-07-22 | A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-ran… |
CVE-2026-8169 | | | 2026-07-20 | ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insu… |
CVE-2026-13577 | High | 8.2 | 2026-07-20 | Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.
Dancer2::Core::Role::SessionFactory::gener… |
CVE-2026-16235 | Critical | 9.8 | 2026-07-20 | Crypt::Password versions through 0.28 for Perl generate insecure random values for salts.
These versions use the built-in rand function, which is predictable… |
CVE-2026-9323 | High | 8.1 | 2026-07-18 | The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9… |
CVE-2026-13082 | Medium | 5.3 | 2026-07-17 | GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.
The random method creates the challenge text used for the CAPTCHA by sampling c… |
CVE-2026-63089 | Critical | 9.3 | 2026-07-16 | WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthentica… |
CVE-2026-61500 | Critical | 9.8 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same gen… |
CVE-2026-14495 | High | 8.8 | 2026-07-08 | The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vul… |
CVE-2026-56016 | Medium | 5.9 | 2026-07-01 | CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources.
The generate_id method builds the session id fr… |
CVE-2026-7830 | High | 7.4 | 2026-07-01 | UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC_MsLogonIIAuth). In rfb/dh.cpp the Diffie-Hellman ke… |
CVE-2026-44040 | Medium | 4.8 | 2026-07-01 | UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to produce VNC authentication challenge bytes. In rfb/vncauth.c:119-129… |
CVE-2026-7874 | Critical | 9.1 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanis… |
CVE-2026-57082 | Medium | 5.9 | 2026-06-30 | Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG.
The MSE (Message Stream Encryption)… |
CVE-2026-9733 | Critical | 9.1 | 2026-06-23 | Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.
When no state generator is specified in the co… |
CVE-2026-56141 | Critical | 9.8 | 2026-06-19 | In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 account takeover via predictable restore codes… |
CVE-2026-9692 | Medium | 5.3 | 2026-06-18 | Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely.
The default session id generator returns a SHA-1 hash seeded w… |
CVE-2026-11832 | Critical | 9.1 | 2026-06-15 | Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce.
The default nonce was generated using an MD5 hash of the epoch time… |
CVE-2026-9638 | High | 7.5 | 2026-06-12 | Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts.
These versions use the built-in rand function, which is predictable… |
CVE-2026-46493 | High | 7.5 | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use `uniqid` for generating salts, which is unsuitable. Version 2… |
CVE-2026-11347 | | | 2026-06-05 | The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically ge… |
CVE-2026-41858 | High | 7.5 | 2026-06-04 | Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to e… |
CVE-2026-8647 | Medium | 4.8 | 2026-05-26 | Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available.
The random_bytes function fell back to… |
CVE-2026-47372 | Critical | 9.1 | 2026-05-20 | Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.
These versions use the built-in rand function, which is predictabl… |
CVE-2026-42155 | | | 2026-05-15 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a… |
CVE-2026-8503 | Medium | 6.5 | 2026-05-15 | Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.
Apache::Session::Generate::SHA256 generated session ids insecur… |
CVE-2026-6146 | Medium | 5.3 | 2026-05-11 | Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.
Amazon::Credentials stores credentials in an obfuscated form to pre… |
CVE-2026-5084 | Medium | 6.5 | 2026-05-11 | WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely.
The session handler generates the session id from an MD5 hash seeded w… |
CVE-2026-6659 | High | 7.5 | 2026-05-08 | Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.
The built-in rand function is predictable, and unsuitable for cryp… |
CVE-2026-41505 | High | 8.7 | 2026-05-07 | RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's make_sign_in_key() functio… |
CVE-2026-5080 | Medium | 5.9 | 2026-04-30 | Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely.
The session id is generated from summing the character codepoints… |
CVE-2026-40975 | Medium | 4.8 | 2026-04-28 | Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used f… |
CVE-2026-40514 | Medium | 5.9 | 2026-04-27 | SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys an… |
CVE-2026-41564 | High | 7.5 | 2026-04-23 | CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking.
The Crypt::PK::RSA, Crypt::PK::DSA, Crypt::PK::DH, Crypt::PK::ECC… |
CVE-2026-5088 | High | 7.5 | 2026-04-15 | Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts.
The _make_salt and _make_salt_bcrypt methods will attept… |
CVE-2026-5085 | Critical | 9.1 | 2026-04-13 | Solstice::Session versions through 1440 for Perl generates session ids insecurely.
The _generateSessionID method returns an MD5 digest seeded by the epoch tim… |
CVE-2026-5083 | Medium | 5.3 | 2026-04-08 | Ado::Sessions versions through 0.935 for Perl generates insecure session ids.
The session id is generated from a SHA-1 hash seeded with the built-in rand func… |
CVE-2026-5082 | Medium | 5.3 | 2026-04-08 | Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id.
The generate_session_id function will attempt to re… |
CVE-2026-25726 | High | 8.1 | 2026-04-03 | Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak pseudo-random number generator math/rand… |
CVE-2026-34871 | Medium | 6.7 | 2026-04-01 | An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Gen… |
CVE-2026-5087 | High | 7.5 | 2026-03-31 | PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely.
PAGI::Middleware::Session::Store::Cookie attemp… |
CVE-2025-15618 | Critical | 9.1 | 2026-03-31 | Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key.
Business::OnlinePayment::StoredTransaction generates a… |
CVE-2026-3256 | Critical | 9.8 | 2026-03-28 | HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids.
HTTP::Session defaults to using HTTP::Session::ID::SHA1 to gen… |
CVE-2025-15604 | Critical | 9.8 | 2026-03-28 | Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions.
In versions 6.06 through 6.16, the random_string func… |
CVE-2026-4599 | Critical | 9.1 | 2026-03-23 | Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMa… |
CVE-2024-57854 | Critical | 9.1 | 2026-03-05 | Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator.
Version v0.003 switched to use Data::Rand::Obscure instead of Crypt… |
CVE-2025-40931 | Critical | 9.1 | 2026-03-05 | Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id.
Apache::Session::Generate::MD5 generates session ids insecurely. The… |
CVE-2025-40926 | Critical | 9.8 | 2026-03-05 | Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely.
The default session id generator returns a SHA-1 hash seede… |
CVE-2026-3255 | Medium | 6.5 | 2026-02-27 | HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function.
The HTTP::Session2 session id generator returns… |
CVE-2025-40932 | High | 8.2 | 2026-02-27 | Apache::SessionX versions through 2.01 for Perl create insecure session id.
Apache::SessionX generates session ids insecurely. The default session id generato… |
CVE-2024-58041 | Critical | 9.1 | 2026-02-24 | Smolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functions.
Smolder 1.51 and earlier for Perl uses the rand() function a… |
CVE-2026-2439 | Critical | 9.8 | 2026-02-16 | Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defa… |
CVE-2025-15578 | Critical | 9.8 | 2026-02-16 | Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP… |
CVE-2025-40905 | High | 7.3 | 2026-02-13 | WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic funct… |
CVE-2025-66630 | Critical | 9.4 | 2026-02-09 | Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an… |
CVE-2025-69217 | High | 7.7 | 2025-12-30 | coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port r… |
CVE-2025-68932 | Critical | 9.8 | 2025-12-27 | FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid(… |
CVE-2025-26379 | | | 2025-12-22 | Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets. |
CVE-2025-67504 | Critical | 9.1 | 2025-12-09 | WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not c… |
CVE-2025-66565 | Critical | 9.8 | 2025-12-09 | Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (c… |
CVE-2025-59390 | Critical | 9.8 | 2025-11-26 | Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not expli… |
CVE-2025-41731 | High | 7.4 | 2025-11-10 | A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the… |
CVE-2024-58040 | Critical | 9.1 | 2025-09-30 | Crypt::RandomEncryption for Perl version 0.01 uses insecure rand() function during encryption. |
CVE-2025-40925 | Critical | 9.1 | 2025-09-20 | Starch versions 0.14 and earlier generate session ids insecurely.
The default session id generator returns a SHA-1 hash seeded with a counter, the epoch time… |
CVE-2025-40933 | High | 7.5 | 2025-09-17 | Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely.
Session ids are generated using an MD5 hash of the epoch time and a call… |
CVE-2025-40920 | High | 8.6 | 2025-08-11 | Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library.
* Data::UUID does not use… |
CVE-2025-54883 | | | 2025-08-06 | Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the getSecureRandomInt function in… |
CVE-2025-7394 | Critical | 9.8 | 2025-07-18 | In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to the potential for predictable values re… |
CVE-2025-40924 | Medium | 6.5 | 2025-07-17 | Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely.
The session id is generated from a (usually SHA-1) hash of a simple c… |
CVE-2025-40919 | Medium | 6.5 | 2025-07-16 | Authen::DigestMD5 versions 0.01 through 0.02 for Perl generate the cnonce insecurely.
The cnonce (client nonce) is generated from an MD5 hash of the PID, the… |
CVE-2025-40918 | Medium | 6.5 | 2025-07-16 | Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely.
The cnonce (client nonce) is generated from an MD5 hash… |
CVE-2025-40923 | High | 7.3 | 2025-07-16 | Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely.
The default session id generator returns a SHA-1 hash seeded with the… |
CVE-2025-40916 | Critical | 9.1 | 2025-06-16 | Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha.
That version uses the built-in rand() funct… |
CVE-2025-40915 | High | 7.0 | 2025-06-11 | Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens.
That version of the module generates tokens as an MD5 of… |
CVE-2024-58135 | Medium | 5.3 | 2025-05-03 | Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default.
When creating a defaul… |
CVE-2025-46653 | Low | 3.1 | 2025-04-26 | Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, he… |
CVE-2025-3495 | Critical | 9.8 | 2025-04-16 | Delta Electronics COMMGR v1 and v2 uses insufficiently randomized values to generate session IDs (CWE-338). An attacker could easily brute force a session ID a… |
CVE-2025-2814 | Medium | 4.0 | 2025-04-13 | Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cry… |
CVE-2025-32755 | Critical | 9.1 | 2025-04-10 | In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on i… |
CVE-2025-32754 | Critical | 9.1 | 2025-04-10 | In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based o… |
CVE-2024-56370 | Medium | 6.5 | 2025-04-05 | Net::Xero 0.044 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functi… |
CVE-2024-52322 | Medium | 5.5 | 2025-04-05 | WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic… |
CVE-2024-58036 | Medium | 5.5 | 2025-04-05 | Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic… |
CVE-2024-57868 | Medium | 5.5 | 2025-04-05 | Web::API 2.8 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions… |
CVE-2024-57835 | Medium | 5.5 | 2025-04-05 | Amon2::Auth::Site::LINE uses the String::Random module to generate nonce values.
String::Random defaults to Perl's built-in predictable random number generat… |
CVE-2025-1805 | Medium | 5.3 | 2025-04-02 | Crypt::Salt for Perl version 0.01 uses insecure rand() function when generating salts for cryptographic purposes. |
CVE-2025-1860 | High | 7.7 | 2025-03-28 | Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic fun… |
CVE-2025-27552 | Medium | 4.0 | 2025-03-26 | DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.
This vulnerability is associated with progr… |
CVE-2025-27551 | Medium | 4.0 | 2025-03-26 | DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.
This vulnerability is associated with progr… |
CVE-2021-26091 | High | 7.5 | 2025-03-24 | A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0… |
CVE-2025-1796 | High | 8.8 | 2025-03-20 | A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random nu… |
CVE-2025-1828 | High | 8.8 | 2025-03-11 | Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions.
If the Provider is n… |
CVE-2024-40762 | Critical | 9.8 | 2025-01-09 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain cases, can be predict… |
CVE-2025-21617 | | | 2025-01-06 | Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure… |