passgen

🔐 passgen — Generate passwords from the terminal A small Go CLI that generates secure random passwords with flexible character sets and exclusions. Uses crypto/rand for cryptographically secure randomness. If no charset flags are provided, all sets are enabled by default. Installation Go latest g...

Thirty-One-Bits

Thirty-One Bits knell Timestamp of record archive.org: https://archive.org/details/knell-thirty-one-bits InfiniteWP Client 1.13.10 — a WordPress management plugin on roughly 200,000 installs — has a second authentication branch, NOSSL, that the enrolling panel selects by setting one request...

CVE-2026-104356-pictshare-weak-delete-code

CVE-2026-104356 — Predictable deletecode via rand in PictShare Authorized security research. PoC for defensive and educational use only. PictShare generates the deletecode authorization token with getRandomString, which draws every character from PHP's non-cryptographic rand. Because rand is not ...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Net::EasyTCP vulnerability (USN-8985-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8985-1 advisory. It was discovered that Net::EasyTCP used the built-in Perl rand function to generate encryption keys when no stron...

Fedora 45 : perl-GD-SecurityImage (2026-825527e021)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-825527e021 advisory. Until now, GD::SecurityImage used Perl's built-in rand function to generate secrets. The rand function is unsuitable for security applications because it is...

CVE-2026-118986

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand. The secret that signs session cookies is built from two calls to the built-in rand, which is seeded with 32 bits. The secret therefore has at most 232 possible values, and one signed...

CVE-2026-118986 CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand. The secret that signs session cookies is built from two calls to the built-in rand, which is seeded with 32 bits. The secret therefore has at most 232 possible values, and one signed...

EUVD-2026-113922

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand. The secret that signs session cookies is built from two calls to the built-in rand, which is seeded with 32 bits. The secret therefore has at most 232 possible values, and one signed...

CVE-2026-118986

Versions of CallBackery for Perl prior to 0.62.0 are vulnerable to session cookie forgery due to the use of a cryptographically weak pseudo-random number generator. The signing secret is generated using two calls to the built-in rand() function, which is seeded with only 32 bits. This limits the ...

PT-2026-133529

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand. The secret that signs session cookies is built from two calls to the built-in rand, which is seeded with 32 bits. The secret therefore has at most 232 possible values, and one signed...

CVE-2026-118986: CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand. The secret that signs session cookies is built from two calls to the built-in rand, which is seeded with 32 bits. The secret therefore has at most 232 possible values, and one signed...

Fedora 43 : perl-GD-SecurityImage (2026-bdeade52d9)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-bdeade52d9 advisory. Until now, GD::SecurityImage used Perl's built-in rand function to generate secrets. The rand function is unsuitable for security applications because it is...

Fedora 44 : perl-GD-SecurityImage (2026-3bf1e0b3f9)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3bf1e0b3f9 advisory. Until now, GD::SecurityImage used Perl's built-in rand function to generate secrets. The rand function is unsuitable for security applications because it is...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356

PictShare, a self-hosted image and media host, is vulnerable to a weak randomness issue in versions prior to 3.7.1 . The getRandomString() function in src/inc/core.php utilizes the non-cryptographic rand() PRNG to generate the delete_code authorization token. Because the same generator produces t...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-53953

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

EUVD-2026-91043

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

CVE-2026-53953 GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...