CVE-2026-19636

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation...

CVE-2026-19636

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation...

CVE-2026-19636

The CVE-2026-19636 issue concerns CSRF token generation using a predictable method. The connected documents confirm a fix that increases randomness and entropy in token generation, addressing the vulnerability. The description does not specify affected products, versions, or exploit details. The ...

CVE-2026-19636 Insuffucient Protections Lead to Brute Force

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation...

EUVD-2026-58736

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation...

Insecure Randomness

Spring AMQP is vulnerable to Predictable Correlation Identifier vulnerability as per NVD Description or CWE-330. The vulnerability is due to correlation IDs for RabbitTemplate.sendAndReceive replies being generated using a predictable internal counter, which allows an attacker to predict...

CVE-2026-52075

mgrandom rand fallback used for TLS secrets...

CVE-2026-18536

A flaw was found in Data-Entropy. This component reads remote entropy randomness sources over unencrypted HTTP. An on-path attacker, such as one on an open Wi-Fi network or a compromised internet service provider ISP, can intercept and alter the responses from these sources. This allows the...

CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851

The CVE-2026-71851 entry describes a vulnerability in crypto-js prior to 4.0.0 where CryptoJS.lib.WordArray.random() uses a non-cryptographically secure PRNG seeded from Math.random(), yielding only 2^39–2^47 entropy. This affects downstream wallets using that entropy for BIP39 recovery phrases, ...

CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

EUVD-2026-54599

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-8470

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...

EUVD-2026-53549

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...

CVE-2026-8470 Langflow is affected by weaknesses in secret handling and sensitive configuration access

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...

CVE-2026-8470

IBM Langflow OSS versions 1.0.0–1.10.3 generate Fernet encryption keys from user secrets using Python’s non-cryptographic random module. The deterministic Mersenne Twister PRNG yields identical keys for identical seeds, enabling an attacker to reproduce encryption keys and decrypt stored API keys...

CVE-2026-8470 Langflow is affected by weaknesses in secret handling and sensitive configuration access

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...

CVE-2026-8470

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...

ROS-20260804-73-0044

The vulnerability of the archuprobecopyixol function in the arch/riscv/kernel/probes/uprobes.c module of the platform management subsystem for the RISCV architecture of the Linux operating system is related to the use of insufficiently random values. Exploiting this vulnerability could allow an...