CVE-2026-13381 VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference IDOR vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server...

CVE-2026-16247

The CVE affects _connect.BRAIN prior to version 5.06. During setup, LogPathConfig.exe is executed and deletes/recreates %ProgramData% permissions, granting the Windows group Everyone full control instead of restricting access to %ProgramData\Bizerba_connect.BRAIN or %ProgramData\Bizerba\BCT. Star...

UBUNTU-CVE-2026-13577

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-16235

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography...

CVE-2026-16235

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography...

UBUNTU-CVE-2026-16235

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography...

CVE-2026-13577

The CVE-2026-13577 entry affects Dancer2 for Perl up to version 2.1.0. When secure PRNG sources (Math::Random::ISAAC::XS, Crypt::URandom) are unavailable, Dancer2::Core::Role::SessionFactory::generate_id falls back to a low-entropy, rand-derived session id. The fallback is computed from a SHA-1 h...

CVE-2026-13577 Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577 Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577 Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-16235 Crypt::Password versions through 0.28 for Perl generate insecure random values for salts

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography...

CVE-2026-16235

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography...

EUVD-2026-45895

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography...

CVE-2026-16235

CVE-2026-16235 affects Crypt::Password for Perl up to version 0.28. The root cause is generation of insecure random values for salts by using the built-in rand function, which is predictable and unsuitable for cryptography. This leads to high-severity impact (confidentiality, integrity, availabil...

CVE-2026-16235

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography...

The vulnerability of the WalletService service in the Windows operating system allows a perpetrator to escalate their privileges.

The vulnerability of the WalletService service in the Windows operating system is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to enhance their privileges...

Linux Distros Unpatched Vulnerability : CVE-2026-13577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable...

AZL-92916 CVE-2026-9323 affecting package python-urwid 2.6.14-1

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...