0x-assert (>=0.0.2, <=0.0.3), 0xauth (>=0.0.5, <=0.1.0) +7325 more potentially affected by CVE-2026-71851 via crypto-js (>=3.1.2, <=3.3.0)

crypto-js NPM version =3.1.2, =0.0.2, =0.0.5, =1.0.0, =1.0.0, =1.34.1, =0.1.0, =4.11.2, =0.0.1, =3.3.9, =3.10.1, =0.0.16-0.1, =0.0.4, =0.0.7 and more Source cves: CVE-2026-71851 Source advisory: SNYK:JS-CRYPTOJS-18599395...

NPM: crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

NPM: crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain vulnerability discovered by ? in WordPress Npm crypto-js versions 4.0.0...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview org.webjars.npm:crypto-js is a library of crypto standards. Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG in the WordArray.random function. An attacker can recover security-sensitive values by enumerating the reduced...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview crypto-js is a library of crypto standards. Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG in the WordArray.random function. An attacker can recover security-sensitive values by enumerating the reduced output space of...

CVE-2026-71851 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

EUVD-2026-54599

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851

The CVE-2026-71851 entry describes a vulnerability in crypto-js prior to 4.0.0 where CryptoJS.lib.WordArray.random() uses a non-cryptographically secure PRNG seeded from Math.random(), yielding only 2^39–2^47 entropy. This affects downstream wallets using that entropy for BIP39 recovery phrases, ...

MAL-2026-13487 Malicious code in flasq (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79bdf17d9c07586ddc0b7121037c2c10019d7be01d2dd49685680a8e876342c6 setup.py registers a custom install cmdclass whose post-install hook is stored as a base64-encoded blob and decoded+exec'd at install time. On Linux,...

Linux Distros Unpatched Vulnerability : CVE-2026-71851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom...

Linux Distros Unpatched Vulnerability : CVE-2020-36732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string 0. with an integer, which makes the output more predictable...

MiracleLinux 9 : podman-5.8.2-4.el9_8 (AXSA:2026-1491:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1491:07 advisory. golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-39835 golang.org/x/crypto/ssh:...

SUSE CVE-2026-64599

In the Linux kernel, the following vulnerability has been resolved: crypto: amlogic - avoid double cleanup in mesoncryptoprobe When mesonallocatechanlist fails after a partial allocation, it already unwinds the allocated chanlist state through its local error path. mesoncryptoprobe then jump to...

CVE-2026-48088

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...

CVE-2026-48088 OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...

CVE-2026-48088 OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...

CVE-2026-48088

OpenReception’s OpenReception appointment-booking software (prior to version 1.0.4) is vulnerable to unauthenticated crypto key provisioning via POST /api/tenants/{tenantId}/staff/{staffId}/crypto, allowing attacker-controlled ML-KEM-768 public keys to be registered for any tenant. The handler lo...