nodejs: nodejs: predictable random values via snapshot entropy cache reuse

A flaw was found in Node.js crypto. Internal entropy caches used by crypto.randomUUID, crypto.randomUUIDv7, and crypto.randomInt can be saved into user-land startup snapshots --build-snapshot and single executable applications built with useSnapshot. If those APIs or dependents such as...

nodejs: nodejs: predictable random values via snapshot entropy cache reuse

A flaw was found in Node.js crypto. Internal entropy caches used by crypto.randomUUID, crypto.randomUUIDv7, and crypto.randomInt can be saved into user-land startup snapshots --build-snapshot and single executable applications built with useSnapshot. If those APIs or dependents such as...

Jack Lloyd Botan encryption issue vulnerability

Versions 3.7.0 through 3.13.0 of Jack Lloyd Botan contain an encryption-related vulnerability. This flaw arises because AutoSeededRNG, when processing an empty output buffer without seeding, fails to consult its configured entropy source; as a result, it marks itself as seeded. Additionally, the...

Flatpak xdg-desktop-portal encryption issue vulnerability

Versions of Flatpak prior to xdg-desktop-portal 1.22.1 contain an encryption vulnerability. This vulnerability arises because malicious sandbox applications can leverage the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeting other applications to themselves...

Red Hat: CVE-2026-106074: nodejs: nodejs: predictable random values via snapshot entropy cache reuse

A flaw in Node.js crypto causes the internal entropy caches used by crypto.randomUUID, crypto.randomUUIDv7, and crypto.randomInt to be saved into user-land startup snapshots --build-snapshot and single executable applications built with useSnapshot. If any of these functions, or an API that relie...

Red Hat: CVE-2026-106074: nodejs: nodejs: predictable random values via snapshot entropy cache reuse

A flaw in Node.js crypto causes the internal entropy caches used by crypto.randomUUID, crypto.randomUUIDv7, and crypto.randomInt to be saved into user-land startup snapshots --build-snapshot and single executable applications built with useSnapshot. If any of these functions, or an API that relie...

Diem project Diem encryption issue vulnerabilities

The Diem project has a vulnerability related to encryption. This vulnerability stems from the use of a cryptographically weak pseudorandom number generator in the dmString::random function found in the file dmCorePlugin/lib/basic/dmString.php. This may lead to the generation of predictable random...

Linux kernel TCP Connection Request Buffer Overflow DoS

The vulnerability of the tcpconnrequest function in the include/net/tcp.h component of the Linux kernel is related to the predictability of random initial numbers for TCP sessions. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

SUSE-SU-2026:3929-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: - CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response...

TP-Link Archer C9 admin password reset (CVE-2017-11519)

Module exploits TP-Link Archer C9 password reset feature by leveraging a predictable random number generator seed. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link Archer C9 admin password reset CVE-2017-11519""" import json import re from kittysploit import from lib.protocols.http.httpclient...

PT-2026-75914

Description src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts both compute their temporary working-file paths as: ts const randNum = Math.floorMath.random 0xFFFFFFFF; const srcFile = $os.tmpdir/etherpad export $randNum.html; const destFile = $os.tmpdir/etherpad export...

PT-2026-59273

An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID...

DAVIDO Bytes::Random::Secure encryption issue vulnerability

Versions 0.29 and earlier of DAVIDO Bytes::Random::Secure contain an encryption-related vulnerability. This vulnerability arises because the internal state of PRNG is shared across processes when objects are initialized or function interfaces are used prior to creating a fork process. As a result...

SINEC INS Network Hashing Brute Force

The vulnerability of the SINEC INS network infrastructure management software is related to the use of one-way hashing with predictable random data. Exploiting this vulnerability could allow an attacker to perform a brute-force attack and gain unauthorized access to protected information...

CVE-2026-45673

A flaw was found in Netty's DNS resolver component. This vulnerability arises from the use of a predictable pseudo-random number generator PRNG for DNS transaction IDs and a static User Datagram Protocol UDP source port. This combination significantly reduces the randomness of DNS queries, making...

MAI-2024-0002

Large Language Models LLMs employed for code generation are susceptible to Malicious Programming Prompts MaPP attacks. In these scenarios, an adversary injects a concise string, typically under 500 bytes, into the prompt. This manipulation compels the LLM to produce code embedded with...

CVE-2026-5084

The WebDyne::Session Perl component (versions before 3.003_704 , and specifically through 2.075 ) contains a vulnerability where session identifiers are generated insecurely. The session handler utilizes an MD5 hash seeded by the built-in rand() function. Because the rand() function is seeded by ...

Weak Random Value Generation For Secrets (weak PRNG)

Spring Boot is vulnerable to the use of a weak pseudo-random number generator PRNG. The vulnerability is due to the use of predictable random value sources e.g., $random.value, $random.int, $random.long, which allows an attacker to guess or brute-force generated secrets and compromise application...

EUVD-2026-10043

CoreDNS Loop Detection Denial of Service Vulnerability...

CVE-2025-40931

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come fro...