CVE-2026-55889

A flaw was found in xdg-desktop-portal. The service uses a predictable pseudorandom number generator PRNG to generate authorization tokens that manage access to shared system resources. By requesting enough tokens to determine the internal state of the generator, a malicious sandboxed application...

RHLW-2026-70779BC964A31A7E Lightwell Security Advisory: netty-resolver-dns 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-resolver-dns 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-45673, CVE-2026-45674, and CVE-2026-47691. CVE-2026-45673: Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port CVE-2026-45674: Netty Vulnerable to D...

debian-ssh

PRNG predecible de OpenSSL de Debian Enlaces URL original: http://metasploit.com/users/hdm/tools/debian-openssl/1 Espejo2 Exploit: https://www.exploit-db.com/exploits/5622/ Perl3 https://www.exploit-db.com/exploits/5720/ Python4 https://www.exploit-db.com/exploits/5632/ Ruby12 Herramienta...

RHLW-2026-7036555A81C446F8 Lightwell Security Advisory: netty-buffer 4.1.132.Final-rhlw-00002

Red Hat Lightwell has released io.netty:netty-buffer 4.1.132.Final-rhlw-00002 with a backported security fix. CVE-2026-45673: Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port This patched artifact is a drop-in replacement for io.netty:netty-buffer 4.1.132.Final fr...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-79901: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

In deployments using BoKS keytab management, affected versions of bokskeytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change tim...

CVE-2026-66372 Predictable Seed in Pseudo-Random Number Generator (PRNG) in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space...

Astra Linux – Vulnerability in mbedtls

A issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0, as well as in TF-PSA-Crypto before 1.1.0. There is a predictable seed in a pseudo-random number generator PRNG...

CVE-2026-62647

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A random number generator is used to generate security-relevant values such as session identifiers used for authentication purposes that is not initialized with a True Random Number Generator TRNG, resulting in a predictable...

CVE-2026-62647: Improper Input Validation

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A random number generator is used to generate security-relevant values such as session identifiers used for authentication purposes that is not initialized with a True Random Number Generator TRNG, resulting in a predictable...

Security Bulletin: Vulnerability in Netty's DnsResolveContext affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Netty's DnsResolveContext has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional...

CVE-2026-3416

WSO2 products' API Publisher component used a non-cryptographic pseudorandom number generator (PRNG) to generate shared secrets for Webhook HMAC validation. Because the PRNG lacks sufficient entropy, a sophisticated attacker can predict future secrets and forge event payloads with valid HMAC sign...

CVE-2026-74887

opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module Mersenne Twister PRNG at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that...

CVE-2026-74874

opensslencrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generatepseudorandomsequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations...

CVE-2026-74874

opensslencrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generatepseudorandomsequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations...

PT-2026-76610

openssl encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate pseudorandom sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations...

CVE-2026-45673

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entrop...

CVE-2026-45673: Use of Insufficiently Random Values

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entrop...

Linux Distros Unpatched Vulnerability : CVE-2026-34871

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number...

PT-2026-32080

Summary The generate pseudorandom sequence function in openssl encrypt/plugins/steganography/core/utils.py at lines 89-91 uses Python's random module Mersenne Twister for steganographic pixel/sample selection. Affected Code python random.seedseed sequence = random.samplerangemax value, minlength,...