CVE-2024-27632

CVE-2024-27632 Vulnerability Details Overview In Savane v3.12 and prior, the Unix timestamp is used as a seed in the Pseudo-Random Number Generator PRNG used to generate Cross-Site Request Forgery CSRF protection tokens formid. As a result, an attacker may be able to independently generate the sa...

CVE-2026-22001-SPHINCS-WOTS-Weak-Randomness-Forgeable-Signature

CVE-2026-22001 – SPHINCS+ WOTS+ Weak Randomness Signature Forgery Overview An implementation of the SPHINCS+ post‑quantum signature scheme uses a flawed random number generator during WOTS+ signature generation. The same nonce k is reused across multiple signatures, allowing an attacker to recove...

EUVD-2026-120525

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post that generates batch share link passwords using Python's non-cryptographic random.choices. Authenticated users permitted to create share links can request many generated passwords via the multi-share-link...

CVE-2026-125362

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post that generates batch share link passwords using Python's non-cryptographic random.choices. Authenticated users permitted to create share links can request many generated passwords via the multi-share-link...

CVE-2026-125362: haiwen seahub: Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch…

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post that generates batch share link passwords using Python's non-cryptographic random.choices. Authenticated users permitted to create share links can request many generated passwords via the multi-share-link...

CVE-2026-125362 Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post that generates batch share link passwords using Python's non-cryptographic random.choices. Authenticated users permitted to create share links can request many generated passwords via the multi-share-link...

CVE-2026-125362

Seahub versions through 14.0.10 are vulnerable to a weak randomness issue in the MultiShareLinksBatch.post() function. The root cause is the use of Python's non-cryptographic random.choices() to generate batch share link passwords. An authenticated user with permissions to create share links can ...

CVE-2026-125362 Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post that generates batch share link passwords using Python's non-cryptographic random.choices. Authenticated users permitted to create share links can request many generated passwords via the multi-share-link...

PT-2026-141185

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post that generates batch share link passwords using Python's non-cryptographic random.choices. Authenticated users permitted to create share links can request many generated passwords via the multi-share-link...

CLEANSTART-2025-VG20813 weak randomness in WebCrypto keygen vulnerability exists in Node

CVE-2022-35255 affects multiple packages. A weak randomness in WebCrypto keygen vulnerability exists in Node. See references for individual vulnerability details...

CVE-2026-105996

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's persona...

CLEANSTART-2026-DB79220 weak randomness in WebCrypto keygen vulnerability exists in Node

Security vulnerability affects the nodejs-24 package. A weak randomness in WebCrypto keygen vulnerability exists in Node...

PT-2026-120449

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's persona...

EUVD-2026-91072

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356

PictShare, a self-hosted image and media host, is vulnerable to a weak randomness issue in versions prior to 3.7.1 . The getRandomString() function in src/inc/core.php utilizes the non-cryptographic rand() PRNG to generate the delete_code authorization token. Because the same generator produces t...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2022_7821)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227821 advisory. nodejs: weak randomness in WebCrypto keygen CVE-2022-35255 nodejs: HTTP Request Smuggling due to incorrect parsing of header fields CVE-2022-35256 Tenable...

PT-2026-104028

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the delete code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete code values and...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2025_1582)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20251582 advisory. undici: Undici Uses Insufficiently Random Values CVE-2025-22150 nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap CVE-2025-23085 Tenable has...