CVE-2026-19742

The Zephyr RTOS IPv6 stack is vulnerable because it uses the non-cryptographically secure sys_rand_get() to derive the secret key for RFC 7217 stable interface identifiers (IIDs) and RFC 8981 temporary IIDs. Because the underlying xoshiro128++ generator is invertible and its state is shared, an a...

CVE-2026-19742 IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key

The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers genstableiid in subsys/net/ip/ipv6.c and RFC 8981 temporary interface identifiers gentemporaryiid in subsys/net/ip/ipv6pe.c with sysrandget. That API is documented as not cryptographically secur...

CVE-2026-19742 IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key

The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers genstableiid in subsys/net/ip/ipv6.c and RFC 8981 temporary interface identifiers gentemporaryiid in subsys/net/ip/ipv6pe.c with sysrandget. That API is documented as not cryptographically secur...

PYSEC-2026-3745

opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module Mersenne Twister PRNG at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that...

CVE-2026-47882

When enabling Spring Boot DevTools support for a remote application target for example a Docker container or Cloud Foundry app from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret w...

CVE-2026-47882 Spring Boot DevTools remote secret generated with a non-cryptographic PRNG

When enabling Spring Boot DevTools support for a remote application target for example a Docker container or Cloud Foundry app from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret w...

CVE-2026-57082 Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG

Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG. The MSE Message Stream Encryption handshake derives its 160-bit Diffie-Hellman private key from Perl's rand, a non-cryptographic drand48-class generator seeded once per proces...

CVE-2026-57082

Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG. The MSE Message Stream Encryption handshake derives its 160-bit Diffie-Hellman private key from Perl's rand, a non-cryptographic drand48-class generator seeded once per proces...

CVE-2021-45489

In NetBSD through 9.2, the IPv6 Flow Label generation algorithm employs a weak cryptographic PRNG...

CVE-2021-45484

In NetBSD through 9.2, the IPv6 fragment ID generation algorithm employs a weak cryptographic PRNG...

CVE-2021-45489

In NetBSD through 9.2, the IPv6 Flow Label generation algorithm employs a weak cryptographic PRNG...

PT-2021-24253

Name of the Vulnerable Software and Affected Versions: NetBSD versions prior to 9.3 Description: The issue concerns a weak cryptographic PRNG used in the IPv6 Flow Label generation algorithm. Recommendations: For NetBSD versions prior to 9.3, update to version 9.3 or later to resolve the issue...

in phpservermon/phpservermon

✍️ Description The random number generator implemented by mtrand cannot withstand a cryptographic attack. Insecure randomness errors occur when a function that can produce predictable values is used as a source of randomness in security-sensitive context. In this case the function that generates...

PT-2019-12029

Name of the Vulnerable Software and Affected Versions pac4j-saml versions 3.X Description The issue arises from the use of the apache commons-lang3 RandomStringUtils class in SAML2Utils.java to generate SAML identifiers. This class uses a pseudorandom number generator PRNG algorithm that is not...

Multiple Vulnerabilities in ntpd Affecting Cisco Products

Multiple Cisco products incorporate a version of the ntpd package. Versions of this package are affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to execute arbitrary code or create a denial of service DoS condition. On December 19, 2014, NTP.org and...