CVE-2025-7783-poc

form-data boundary randomness vulnerability CVE-2025-7783 Largely based on https://hackerone.com/reports/2913312 by https://hackerone.com/parrot409?type=user Installing: npm install Make sure you have python3 installed with the z3 module pip3 install -r requirements.txt -- the exploit code shells...

java-insecure-random-cve-2021-27568

java-insecure-random-cve-2021-27568 Demo of CVE-2021-27568: Insecure randomness in token generation...

CVE-2024-27632

CVE-2024-27632 Vulnerability Details Overview In Savane v3.12 and prior, the Unix timestamp is used as a seed in the Pseudo-Random Number Generator PRNG used to generate Cross-Site Request Forgery CSRF protection tokens formid. As a result, an attacker may be able to independently generate the sa...

vLLM 0.8.3 - 0.14.0 - Information Disclosure

vLLM 0.8.3 to - 0.14.1 contains an information disclosure caused by leaking a heap address in error messages from the multimodal endpoint when processing invalid images, letting remote attackers reduce ASLR entropy, exploit requires sending invalid images. id: CVE-2026-22778 info: name: vLLM 0.8....

php_mt_seed

phpmtseed phpmtseed is a PHP mtrand seed cracker. In the most trivial invocation mode, it finds possible seeds given the very first mtrand output after possible seeding with mtsrand. With advanced invocation modes, it is also able to match multiple, non-first, and/or inexact mtrand outputs to...

CVE-2026-22001-SPHINCS-WOTS-Weak-Randomness-Forgeable-Signature

CVE-2026-22001 – SPHINCS+ WOTS+ 약한 난수 서명 위조 개요 SPHINCS+ 포스트퀀텀 서명 체계의 한 구현이 WOTS+ 서명 생성 중 결함이 있는 난수 생성기를 사용합니다. 동일한 nonce k가 여러 서명에 걸쳐 재사용되어, 공격자가 개인 키를 복구하고 임의의 메시지를 위조할 수 있습니다. 취약점 세부 정보 유형: 암호학적 난수 생성 실패 영향: 완전한 키 노출, 서명 위조. 근본 원인: WOTS+ 서명 알고리즘은 각 서명마다 고유한 난수 값 k에 의존합니다. k의 재사용은 시드를 드러내는 대수적 관...

CVE-2026-80922

CVE-2026-80922 affects the Linux kernel component crypto: qcom-rng (Qualcomm RNG driver). The root cause is that the driver incorrectly rejected zero as an invalid random number, even though zero is a legitimate random value. This rejection makes the RNG output distinguishable from true randomnes...

CVE-2026-53939

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 together with any key-management algorithm th...

CVE-2026-62646

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...

EUVD-2026-72661

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...

CVE-2026-62646

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...

CVE-2026-86187

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

ROS-20260901-73-0043

The vulnerability in Netty is related to the use of insufficiently random values. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-81852

Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...

EEF-CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

Summary Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces ...

CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...

EUVD-2026-68328

Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...

CVE-2026-81852

AshAdmin (ash-project/ash_admin), an Elixir/Phoenix library, shipped a hardcoded CSP nonce (ash_admin-Ed55GFnX) as a compile-time constant when mounted without the :csp_nonce_assign_key option. This value was written verbatim into inline and [removed] tags on every response and was never rotated...

CVE-2026-82555

A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866B20220506. This vulnerability affects the function loginAuth of the file /webcste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack...

EUVD-2026-68277

A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866B20220506. This vulnerability affects the function loginAuth of the file /webcste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack...