CVE-2026-33710: Use of Insufficiently Random Values

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5time + userid 5 - rand10000, 10000. The rand10000, 10000 call always returns exactly 10000 min == max, making the formula effectively md5timestamp + userid5 - 10000. An attacker who...

dist_corr (>=0.1.0, <=0.1.1), mcproto (>=0.1.0, <=0.1.2) +4 more potentially affected by unknown CVE via rand (0.10.0-rc.8)

rand CARGO version 0.10.0-rc.8 is affected by a known vulnerability. The following packages have a transitive dependency on rand and may be impacted: - distcorr =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.5.7, =0.6.0 - randdistr 0.6.0-rc.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0097...

auth_service_dhz (0.1.9), bin-proto (>=0.9.1, <=0.12.6) +9 more potentially affected by unknown CVE via rand (>=0.9.0, <=0.9.2)

rand CARGO version =0.9.0, =0.9.1, =0.1.0, =0.14.0, =0.1.0, =1.3.0, =2.1.0, =0.5.0-alpha.0, =0.8.6, =0.1.2, =0.3.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0097...

a3mo_lib (>=0.1.0, <=0.1.1), abacuz (>=0.1.0, <=0.1.1) +10169 more potentially affected by unknown CVE via rand (>=0.7.0-pre.2, <=0.8.5)

rand CARGO version =0.7.0-pre.2, =0.1.0, =0.1.0, =0.1.0, =0.7.0, =0.2.0-beta.4, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.0.44, =0.0.5, =0.0.5, =0.0.14 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0097...

RUSTSEC-2026-0097 Rand is unsound with a custom logger using `rand::rng()`

It has been reported by @lopopolo that the rand library is unsound i.e. that safe code using the public API can cause Undefined Behaviour when all the following conditions are met: - The log and threadrng features are enabled - A custom logger is defined - The custom logger accesses rand::rng...

CVE-2026-5082: Generation of Predictable Numbers or Identifiers

Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id. The generatesessionid function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes using SHA-1 hash seeded with the built-in rand...

CVE-2026-5083: Generation of Predictable Numbers or Identifiers

Ado::Sessions versions through 0.935 for Perl generates insecure session ids. The session id is generated from a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked fr...

CVE-2026-33184: Integer Underflow (Wrap or Wraparound)

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, the discovery handler accepts a peer-controlled limit during handshake and stores it unchanged. The immediate HandshakeAck path then honors lim...

CVE-2026-25726: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak pseudo-random number generator math/rand seeded with time.Now.UnixNano to generate critical security secrets, including the secretkey, and hashidsalt. These secrets are generated...

CVE-2026-5087

PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely. PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails for example, on systems without the device, such as Windows, then it...

CVE-2026-5087 PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely

PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely. PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails for example, on systems without the device, such as Windows, then it...

CVE-2025-15618 Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key

Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key. Business::OnlinePayment::StoredTransaction generates a secret key by using a MD5 hash of a single call to the built-in rand function, which is unsuitable for cryptographic use. This key is...

CVE-2025-40931

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come fro...

CVE-2024-57854

Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's built-in rand function, which is not suitable fo...

EUVD-2024-55467

Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's built-in rand function, which is not suitable fo...

CVE-2024-57854

Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's built-in rand function, which is not suitable fo...

CVE-2024-57854 Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator

Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's built-in rand function, which is not suitable fo...

CVE-2024-57854

The Net::NSCA::Client Perl library versions through 0.009002 are vulnerable to the use of a cryptographically weak pseudo-random number generator (PRNG) . Specifically, starting from version v0.003, the library switched to Data::Rand::Obscure instead of Crypt::Random for generating initialization...

CVE-2024-57854 Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator

Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's built-in rand function, which is not suitable fo...

CVE-2025-40926 Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely

Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be...