CVE-2026-92749

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

EUVD-2026-81021

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-92749 SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-92749 SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

PT-2026-94035

Name of the Vulnerable Software and Affected Versions SafeLine versions prior to 9.4.2 Description The management console session-signing secret is derived from a time-seeded math/rand generator. This allows unauthenticated remote attackers who can determine the installation timestamp to...

GHSA-W67G-5RQW-F597 Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

gorilla/websocket used math/rand cryptographically weak pseudo-random number generator to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic output when seeded with ...

Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

gorilla/websocket used math/rand cryptographically weak pseudo-random number generator to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic output when seeded with ...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview github.com/gorilla/websocket is a Go implementation of the WebSocket protocol. Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG via the newMaskKey function in conn.go. An attacker can predict or recover WebSocket frame...

PT-2026-82008

gorilla/websocket used math/rand cryptographically weak pseudo-random number generator to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic output when seeded with ...

CVE-2026-18611 Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials

A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB root/user passwords and MinIO access/secret keys, if they can access the MinIO Route or MariaDB Service. The flaw occurs because the...

CVE-2026-18611

The CVE-2026-18611 entry affects the Data Science Pipelines Operator. The root cause is the use of a cryptographically weak pseudo-random number generator to generate credentials (MariaDB root/user passwords and MinIO access/secret keys). An unauthenticated attacker who can access the MinIO Route...

CVE-2026-25726: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak pseudo-random number generator math/rand seeded with time.Now.UnixNano to generate critical security secrets, including the secretkey, and hashidsalt. These secrets are generated...

Golf may allow attacker to bypass CSRF protections due to weak PRNG

CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests...

CVE-2016-15005

CVE-2016-15005 affects the Go project github.com/dinever/golf. The root cause is CSRF tokens generated with math/rand, which is not cryptographically secure, allowing an attacker to predict token values and bypass CSRF protections with relatively few requests. Impact described across sources: CSR...

CVE-2016-15005

CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests...

CVE-2016-15005: Cross-Site Request Forgery (CSRF)

CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests...

PT-2021-8422

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to the generation of CSRF tokens using a non-cryptographically secure random number generator, specifically math/rand. This allows an...

Security update for rclone (moderate)

openSUSE Security Update: Security update for rclone Announcement ID: openSUSE-SU-2021:0272-1 Rating: moderate References: 1179005 Cross-References: CVE-2020-28924 CVSS scores: CVE-2020-28924 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP2 A...

Security update for rclone (moderate)

openSUSE Security Update: Security update for rclone Announcement ID: openSUSE-SU-2020:2168-1 Rating: moderate References: 1179005 Cross-References: CVE-2020-28924 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes one vulnerability is now available. Description: This update fo...

CVE-2019-19794

The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries...