librest: weak random number generation in PKCE implementation

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...

Bluetooth-Attacks-CVE-2025-27840

This paper discusses how an attacker can introduce a hidden list of vulnerabilities through module updates, which can lead to compromise of ESP32 devices and gaining unauthorized access to private keys, affecting billions of devices using this microcontroller. One of the key issues is the...

sslWeakness

sslWeakness Example script demonstrating a weak PRNG, CVE-2008-0166...

CVE-2024-29868

CVE-2024-29868: Verwendung eines kryptografisch schwachen PRNG bei der Generierung von Wiederherstellungs-Tokens Dieses Repository enthält den Proof of Concept zu CVE-2024-29868 , der Apache StreamPipes von Version 0.69.0 bis 0.93.0 betrifft. Beschreibung : Schwachstelle durch Verwendung eines...

CVE-2026-19718

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote...

CVE-2026-19718 BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote...

EUVD-2026-66276

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote...

CVE-2026-19718

CVE-2026-19718 affects three WordPress plugins — BlogVault Backup & Staging , MalCare WordPress Security , and The WP Remote (versions 5.16–6.62) — where a weak pseudo-random number generator is used to create the connection key secret that binds a site to its remote management service. Unauthent...

GO-2026-6278 Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in github.com/gorilla/websocket

Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in github.com/gorilla/websocket...

GHSA-W67G-5RQW-F597 Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

gorilla/websocket used math/rand cryptographically weak pseudo-random number generator to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic output when seeded with ...

ANT-2026-110HTZ5M · jsrsasign · Cryptographically Weak PRNG / Predictable ECDSA Nonce

other high Severity Claude high · Security research firm high · Maintainer - REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif. ANT-2026-110HTZ5M: jsrsasign npm — ECDSA nonce RNG seeded entirely from Math.random in Node.js The npm wrapper at...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

CVE-2026-74874

openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module (Mersenne Twister) for steganographic pixel selection in the generate_pseudorandom_sequence() function (openssl_encrypt/plugins/steganography/core/utils.py, lines 89–91). The Mersenne Twister state is recoverable f...

CVE-2026-74874 openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection

opensslencrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generatepseudorandomsequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations...

CVE-2026-74874 openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection

opensslencrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generatepseudorandomsequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations...

CVE-2026-73567

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by [email protected], which seeds an ARC4 strea...

CVE-2026-73576

CVE-2026-73576 affects Zimbra Collaboration (ZCS) before 10.1.17 via the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated with an insecure RNG, yielding insufficient entropy. This may allow offline brute-forcing to recover the JWT signing secret, enabling JWT forgery and po...

PT-2026-71715

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by [email protected], which seeds an ARC4 strea...

CVE-2026-18611

A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB root/user passwords and MinIO access/secret keys, if they can access the MinIO Route or MariaDB Service. The flaw occurs because the...

CVE-2026-18611

A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB root/user passwords and MinIO access/secret keys, if they can access the MinIO Route or MariaDB Service. The flaw occurs because the...