CLEANSTART-2024-OZ46983 When instructing cloud-init to set a random password for a new user account, versions before 21

Security vulnerability affects the cloud-init package. When instructing cloud-init to set a random password for a new user account, versions before 21...

jwt-pro (>=1.0.0, <=1.0.2), octo-onedrive (0.0.7) +3 more potentially affected by CVE-2026-69248 via cryptography (38.0.0)

cryptography PYPI version 38.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - jwt-pro =1.0.0, =0.3.2, =1.0.0, =1.0.3, =1.0.16 Source cves: CVE-2026-69248 Source advisory: OSV:PYSEC-2026-3554...

jwt-pro (>=1.0.0, <=1.0.2), octo-onedrive (0.0.7) +3 more potentially affected by CVE-2026-69249 via cryptography (38.0.0)

cryptography PYPI version 38.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - jwt-pro =1.0.0, =0.3.2, =1.0.0, =1.0.3, =1.0.16 Source cves: CVE-2026-69249 Source advisory: OSV:PYSEC-2026-3553...

CVE-2026-47831

Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-stemcell-builder allows a remote attacker to brute-force the resulting SSH login via TCP/22. Affected versions: bosh-windows-stemcell-builder versions prior to v2019.98...

EUVD-2026-42517

Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-stemcell-builder allows a remote attacker to brute-force the resulting SSH login via TCP/22. Affected versions: bosh-windows-stemcell-builder versions prior to v2019.98...

jwt-pro (>=1.0.0, <=1.0.2), octo-onedrive (0.0.7) +3 more potentially affected by CVE-2023-50782 via cryptography (38.0.0)

cryptography PYPI version 38.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - jwt-pro =1.0.0, =0.3.2, =1.0.0, =1.0.3, =1.0.16 Source cves: CVE-2023-50782 Source advisory: OSV:PYSEC-2026-1283...

jwt-pro (>=1.0.0, <=1.0.2), octo-onedrive (0.0.7) +3 more potentially affected by CVE-2024-0727 via cryptography (38.0.0)

cryptography PYPI version 38.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - jwt-pro =1.0.0, =0.3.2, =1.0.0, =1.0.3, =1.0.16 Source cves: CVE-2024-0727 Source advisory: OSV:PYSEC-2026-1285...

CVE-2026-41858

Weak Randomness / Insecure Cryptographic Primitive CWE-338 in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomizepassword job exists solely t...

CVE-2026-41858

Weak Randomness / Insecure Cryptographic Primitive CWE-338 in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomizepassword job exists solely t...

CVE-2026-41858

Weak Randomness / Insecure Cryptographic Primitive CWE-338 in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomizepassword job exists solely t...

CVE-2026-41858

Weak Randomness / Insecure Cryptographic Primitive CWE-338 in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomizepassword job exists solely t...

EUVD-2026-34195

Weak Randomness / Insecure Cryptographic Primitive CWE-338 in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomizepassword job exists solely t...

CVE-2026-41858

The CVE fixes a weakness in Get-RandomPassword within BOSH-Ecosystem’s windows-utilities-release. The password for the Administrator account is derived from a clock-seeded PRNG, allowing a network attacker who can estimate VM boot time to reconstruct a small candidate list and recover the Adminis...

Cloud Foundry Windows-Utilities-Release security vulnerabilities

Cloud Foundry Windows-Utilities-Release is a collection of Windows platform maintenance tools provided by the Cloud Foundry company. There are security vulnerabilities in Cloud Foundry Foundation Windows-Utilities-Release; these vulnerabilities stem from the use of a predictable random number...

PT-2026-46132

Name of the Vulnerable Software and Affected Versions windows-utilities-release versions prior to 0.23.0 Description The Get-RandomPassword function in the randomize password job uses a predictable, clock-seeded Pseudo-Random Number Generator PRNG, which is an algorithm for generating a sequence ...

CVE-2026-41858 - Brute forceable windows admin creds | Cloud Foundry

CVSS score: 6.5 Medium CVSS:3/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Vendor CloudFoundry Foundation Versions Affected Severity is HIGH unless otherwise noted. windows-utilities-release – All versions prior to v0.23.0 Description Weak Randomness / Insecure Cryptographic Primitive CWE-338 in...

jwt-pro (>=1.0.0, <=1.0.2), octo-onedrive (0.0.7) +3 more potentially affected by CVE-2026-34073 via cryptography (38.0.0)

cryptography PYPI version 38.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - jwt-pro =1.0.0, =0.3.2, =1.0.0, =1.0.3, =1.0.16 Source cves: CVE-2026-34073 Source advisory: OSV:PYSEC-2026-35...

jwt-pro (>=1.0.0, <=1.0.2), octo-onedrive (0.0.7) +3 more potentially affected by CVE-2026-34073 via cryptography (38.0.0)

cryptography PYPI version 38.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - jwt-pro =1.0.0, =0.3.2, =1.0.0, =1.0.3, =1.0.16 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

jwt-pro (>=1.0.0, <=1.0.2), octo-onedrive (0.0.7) +3 more potentially affected by CVE-2026-26007 via cryptography (38.0.0)

cryptography PYPI version 38.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - jwt-pro =1.0.0, =0.3.2, =1.0.0, =1.0.3, =1.0.16 Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...

jwt-pro (>=1.0.0, <=1.0.2), octo-onedrive (0.0.7) +3 more potentially affected by CVE-2026-26007 via cryptography (38.0.0)

cryptography PYPI version 38.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - jwt-pro =1.0.0, =0.3.2, =1.0.0, =1.0.3, =1.0.16 Source cves: CVE-2026-26007 Source advisory: OSV:GHSA-R6PH-V2QM-Q3C2...