CVE-2026-107283: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest...

GHSA-JXW3-MJMX-3PQM Langflow: Weak Fernet Key via random.seed()

Summary Langflow uses Python's random module Mersenne Twister, a non-cryptographic PRNG seeded with the SECRETKEY to derive the Fernet encryption key for all stored user credentials API keys, LLM provider secrets, database passwords. When the SECRETKEY is shorter than 32 characters — a common...

Langflow: Weak Fernet Key via random.seed()

Summary Langflow uses Python's random module Mersenne Twister, a non-cryptographic PRNG seeded with the SECRETKEY to derive the Fernet encryption key for all stored user credentials API keys, LLM provider secrets, database passwords. When the SECRETKEY is shorter than 32 characters — a common...

Exploit for CVE-2026-104356

CVE-2026-104356 — Predictable deletecode via rand in Pi...

MGASA-2026-0466 Updated python-urwid & python-wcwidth packages fixes a security vulnerability

Insecure PRNG and Information Exposure in urwid Web Display Backend...

Updated python-urwid & python-wcwidth packages fixes a security vulnerability

Insecure PRNG and Information Exposure in urwid Web Display Backend...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-53953: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

CVE-2026-79901: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

In deployments using BoKS keytab management, affected versions of bokskeytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change tim...

CVE-2026-104356: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

Rocky Linux 9 [CIQ] Security Update: bind9.18 / bind9.18-chroot / bind9.18-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_21111)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202521111 advisory. bind: Cache poisoning attacks with unsolicited RRs CVE-2025-40778 bind: Cache poisoning due to weak PRNG CVE-2025-40780 bind: Resource exhaustion via...

Rocky Linux 8 [CIQ] Security Update: bind9.16 / bind9.16-chroot / bind9.16-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_19793)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202519793 advisory. bind: Cache poisoning attacks with unsolicited RRs CVE-2025-40778 bind: Cache poisoning due to weak PRNG CVE-2025-40780 Tenable has extracted the precedin...

Rocky Linux 9 [CIQ] Security Update: bind / bind-chroot / bind-debuginfo / bind-debugsource / bind-devel / etc Multiple Vulnerabilities (crlsa-2025_21110)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202521110 advisory. bind: Cache poisoning attacks with unsolicited RRs CVE-2025-40778 bind: Cache poisoning due to weak PRNG CVE-2025-40780 Tenable has extracted the precedin...

Exploit for CVE-2026-61500

CVE-2026-61500: Rejetto HFS session forgery to RCE !Real ter...

CVE-2026-94456

Postiz generates security-sensitive credentials using Math.random instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s...

CVE-2026-94456 Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

Postiz generates security-sensitive credentials using Math.random instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s...

CVE-2026-94456 Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

Postiz generates security-sensitive credentials using Math.random instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s...

CVE-2026-94456 Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

Postiz generates security-sensitive credentials using Math.random instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s...

CVE-2026-94456: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Postiz generates security-sensitive credentials using Math.random instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s...

Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure.

A flaw was found in Spring Boot. The $random.value property source utilizes a weak pseudo-random number generator PRNG, meaning the values it produces are not sufficiently random for use as cryptographic secrets. An attacker could potentially predict these values, which may lead to information...