1590 matches found
CVE-2026-3256
HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come...
CVE-2025-15604 Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions
Amon2 versions before 6.17 for Perl use an insecure randomstring implementation for security functions. In versions 6.06 through 6.16, the randomstring function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes by concatenating a SHA-1 has...
PT-2026-28276
Name of the Vulnerable Software and Affected Versions Amon2 versions prior to 6.17 Description Amon2 for Perl utilizes an insecure random string implementation in its security functions. Versions 6.06 through 6.16 attempt to use /dev/urandom, but fall back to a SHA-1 hash seeded with the built-in...
The vulnerability of the tegra_eqos_probe() function in the drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c file of the Ethernet adapter support driver from STMicroelectronics’ Linux operating system allows a hacker to cause a service failure.
The vulnerability of the tegraeqosprobe function in the drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c file of the Ethernet adapter support driver from STMicroelectronics’ Linux operating system is related to the use of insufficiently random values. Exploiting this vulnerability could...
The vulnerability of the `bitmap_ip_create()` function in the `net/netfilter/ipset/ip_set_bitmap_ip.c` module of the `netfilter` component of the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the bitmapipcreate function in the net/netfilter/ipset/ipsetbitmapip.c module of the netfilter component in the Linux operating system’s kernel is related to the use of insufficiently random values. Exploiting this vulnerability could allow an attacker to cause a service...
The vulnerability of the paging64_cmpxchg_gpte() function in the arch/x86/kvm/mmu/paging_tmpl.h subsystem of the virtualization subsystem on the Linux kernel-based x86 platform allows a attacker to cause a service failure.
The vulnerability of the paging64cmpxchggpte function in the arch/x86/kvm/mmu/pagingtmpl.h subsystem of the virtualization subsystem on the Linux x86 kernel platform is related to the use of insufficiently random values. Exploiting this vulnerability could allow an attacker to cause a service...
The vulnerability of the Nextcloud Calendar application, a cloud-based software for creating and using Nextcloud data storage, relates to the use of insufficiently random values. This vulnerability allows attackers to compromise the confidentiality and integrity of the protected information.
The vulnerability of the Nextcloud Calendar application, a cloud-based software for creating and managing Nextcloud data storage, is related to the use of insufficiently random values. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of the...
USN-8094-2: Linux kernel vulnerabilities
Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module LSM. An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information kernel memory, local...
CVE-2026-28506 Outline's Information Disclosure in Activity Logs allows User Enumeration of Private Drafts
Outline is a service that allows for collaborative documentation. Prior to 1.5.0, the events.list API endpoint, used for retrieving activity logs, contains a logic flaw in its filtering mechanism. It allows any authenticated user to retrieve activity events associated with documents that have no...
Security Bulletin: Multiple vulnerabilities in QRadar Suite Software
Summary Multiple vulnerabilities were addressed in IBM Security QRadar Suite Software version 1.11.9.0 Vulnerability Details CVEID:CVE-2025-22150 DESCRIPTION: Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses Math.random to choose...
[SECURITY] Fedora 42 Update: perl-Crypt-SysRandom-XS-0.011-1.fc42
This module uses whatever C interface is available to procure cryptographically random data from the system...
EUVD-2025-208452
A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/startwindows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUISECRETKEY leads to insufficiently random values. It is possible to launch the attack...
Withdrawn Advisory: Open WebUI JWT Key Handler
Withdrawn Advisory This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references. Original Description A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file...
GHSA-2RF6-9RC8-RQCH Withdrawn Advisory: Open WebUI JWT Key Handler
Withdrawn Advisory This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references. Original Description A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file...
CVE-2025-15603
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh...
CVE-2025-15603
Open WebUI up to version 0.6.16 is reported to contain a security issue in the JWT Key Handler, specifically in the file backend/start_windows.bat. Manipulating the WEBUI_SECRET_KEY argument can lead to insufficient randomness in keys, potentially enabling remote exploitation. Multiple connected ...
CVE-2025-15603
REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh, startwindows.ba...
CVE-2025-15603
...
Open WebUI 安全特征问题漏洞
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI with open-source code. Versions of Open WebUI prior to 0.6.16 have a security vulnerability related to the parameter WEBUISECRETKEY, where insufficient randomness was present in the handling of this parameter...