326 matches found
CVE-2024-27632
CVE-2024-27632 Vulnerability Details Overview In Savane v3.12 and prior, the Unix timestamp is used as a seed in the Pseudo-Random Number Generator PRNG used to generate Cross-Site Request Forgery CSRF protection tokens formid. As a result, an attacker may be able to independently generate the sa...
CVE-2026-22001-SPHINCS-WOTS-Weak-Randomness-Forgeable-Signature
CVE-2026-22001 – SPHINCS+ WOTS+ Weak Randomness Signature Forgery Overview An implementation of the SPHINCS+ post‑quantum signature scheme uses a flawed random number generator during WOTS+ signature generation. The same nonce k is reused across multiple signatures, allowing an attacker to recove...
CVE-2026-62646
A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...
EUVD-2026-72661
A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...
CVE-2026-62646
A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...
CVE-2026-86187
WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...
CVE-2026-82555
A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866B20220506. This vulnerability affects the function loginAuth of the file /webcste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack...
OPENSUSE-SU-2026:21694-1 Security update for librest
This update for librest fixes the following issue: - CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-random number generator bsc1272399...
Astra Linux – Vulnerability in node-form-data
The use of insufficiently random values in form-data allows for HTTP Parameter Pollution HPP. This vulnerability is associated with the program file lib/formdata.Js. This issue affects form-data versions: 2.5.4, 3.0.0 – 3.0.3, 4.0.0 – 4.0.3...
python-urwid security update
1.3.1-5 - Use secure random session identifiers in web display CVE-2026-9323 - Resolves: RHEL-212562...
CVE-2026-64964
ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation...
CVE-2026-19906
A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to insufficient entropy. The attack may b...
ejabberd -- Multiple security vulnerabilities
ejabberd team reports: It's possible to craft PLAIN auth request and authenticate as one user, but then open session for different one. modcaps persistent cache can be poisoned by using legacy version requests.This cache was only used to determine list of nodes that should trigger notifications i...
RLSA-2026:47085 Important: rest security update
The rest packages provide a library for access to the RESTful web services. Security Fixes: librest: weak random number generation in PKCE implementation CVE-2026-16615 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information,...
rest security update
An update is available for rest. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The rest packages provide a library for access to the RESTful web services...
RockyLinux 10 : rest (RLSA-2026:47085)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:47085 advisory. librest: weak random number generation in PKCE implementation CVE-2026-16615 Tenable has extracted the preceding description block directly from the RockyLinux...
Oracle Linux 10 : rest (ELSA-2026-47085)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47085 advisory. 0.9.1-11.1 - Add patch for CVE-2026-16615 Weak random number generation in PKCE implementation Resolves: RHEL-213749 Tenable has extracted the preceding...
librest: weak random number generation in PKCE implementation
A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...
Important: Red Hat Security Advisory: rest security update
An update for rest is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...