vLLM 0.8.3 - 0.14.0 - Information Disclosure

vLLM 0.8.3 to - 0.14.1 contains an information disclosure caused by leaking a heap address in error messages from the multimodal endpoint when processing invalid images, letting remote attackers reduce ASLR entropy, exploit requires sending invalid images. id: CVE-2026-22778 info: name: vLLM 0.8....

php_mt_seed

phpmtseed phpmtseed é um quebrador de sementes seed cracker do mtrand do PHP. No modo de invocação mais trivial, ele encontra possíveis sementes dada a primeira saída de mtrand após possível semeadura com mtsrand. Com modos de invocação avançados, ele também é capaz de corresponder múltiplas saíd...

CVE-2025-7783-poc

vulnerabilidade de aleatoriedade do boundary form-data CVE-2025-7783 Baseado largamente em https://hackerone.com/reports/2913312 por https://hackerone.com/parrot409?type=user Instalação: npm install Certifique-se de ter python3 instalado com o módulo z3 pip3 install -r requirements.txt -- o códig...

java-insecure-random-cve-2021-27568

java-insecure-random-cve-2021-27568 Демонстрация CVE-2021-27568: Небезопасная случайность при генерации токенов...

CVE-2024-27632

Dettagli sulla Vulnerabilità CVE-2024-27632 Panoramica In Savane v3.12 e versioni precedenti, il timestamp Unix viene utilizzato come seme nel Generatore di Numeri Pseudo-Casuali PRNG impiegato per generare i token di protezione contro la Cross-Site Request Forgery CSRF formid. Di conseguenza, un...

CVE-2026-22001-SPHINCS-WOTS-Weak-Randomness-Forgeable-Signature

CVE-2026-22001 – Falsificazione di firma per debole casualità in SPHINCS+ WOTS+ Panoramica Un'implementazione dello schema di firma post‑quantum SPHINCS+ utilizza un generatore di numeri casuali difettoso durante la generazione delle firme WOTS+. Lo stesso nonce k viene riutilizzato su più firme,...

python-urwid security update

1.3.1-5 - Use secure random session identifiers in web display CVE-2026-9323 - Resolves: RHEL-212562...

Oracle Linux 10 : python-urwid (ELSA-2026-58561)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-58561 advisory. 2.5.3-5 - Use secure random session identifiers Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

CVE-2026-64964

ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation...

EUVD-2026-63364

ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation...

CVE-2026-19906

A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to insufficient entropy. The attack may b...

CVE-2026-19896

A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function buildsecretkey of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexit...

EUVD-2026-59768

A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function buildsecretkey of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexit...

CVE-2026-19896

A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function buildsecretkey of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexit...

CVE-2026-19896 mangroup dtale Flask Session Cookie app.py build_secret_key random values

A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function buildsecretkey of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexit...

CVE-2026-19896 mangroup dtale Flask Session Cookie app.py build_secret_key random values

A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function buildsecretkey of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexit...

CVE-2026-19896

CVE-2026-19896 affects mangroup dtale up to version 3.22.0, targeting the build_secret_key function in dtale/app.py (Flask Session Cookie). The issue causes insufficiently random values, enabling remote exploitation with high attack complexity and published exploits. A fix is pending approval via...

PT-2026-73036

Name of the Vulnerable Software and Affected Versions mangroup dtale versions prior to 3.22.1 Description A flaw in the Flask Session Cookie component allows for the generation of insufficiently random values. This issue occurs within the build secret key function located in the dtale/app.py file...

CVE-2026-19636

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation...

CVE-2026-19636

The CVE-2026-19636 issue concerns CSRF token generation using a predictable method. The connected documents confirm a fix that increases randomness and entropy in token generation, addressing the vulnerability. The description does not specify affected products, versions, or exploit details. The ...