Oracle Linux 9 : bind (ELSA-2026-8075)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-8075 advisory. - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone CVE-2026-1519 - Prevent cache poisoning due to weak PRNG CVE-2025-40780 Tenable has...

CVE-2026-25726

CVE-2026-25726 (Cloudreve) : Prior to 4.13.0, Cloudreve uses the weak Go PRNG math/rand seeded with time.Now().UnixNano() to generate critical secrets (secret_key, hash_id_salt) stored in the DB. An attacker can fetch the administrator account creation time via public APIs, brute-force the PRNG s...

CVE-2025-15604 Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions

Amon2 versions before 6.17 for Perl use an insecure randomstring implementation for security functions. In versions 6.06 through 6.16, the randomstring function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes by concatenating a SHA-1 has...

netfilter Bitmap IP Set Buffer Overflow DoS

The vulnerability of the bitmapipcreate function in the net/netfilter/ipset/ipsetbitmapip.c module of the netfilter component in the Linux operating system’s kernel is related to the use of insufficiently random values. Exploiting this vulnerability could allow an attacker to cause a service...

STMicroelectronics Ethernet Adapter Heap Buffer Overflow DoS

The vulnerability of the tegraeqosprobe function in the drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c file of the Ethernet adapter support driver from STMicroelectronics’ Linux operating system is related to the use of insufficiently random values. Exploiting this vulnerability could...

EUVD-2025-208452

A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/startwindows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUISECRETKEY leads to insufficiently random values. It is possible to launch the attack...

Withdrawn Advisory: Open WebUI JWT Key Handler

Withdrawn Advisory This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references. Original Description A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file...

GHSA-2RF6-9RC8-RQCH Withdrawn Advisory: Open WebUI JWT Key Handler

Withdrawn Advisory This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references. Original Description A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file...

CVE-2025-15603

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh...

CVE-2025-15603

...

CVE-2025-15603

Open WebUI up to version 0.6.16 is reported to contain a security issue in the JWT Key Handler, specifically in the file backend/start_windows.bat. Manipulating the WEBUI_SECRET_KEY argument can lead to insufficient randomness in keys, potentially enabling remote exploitation. Multiple connected ...

CVE-2025-15603

...

CVE-2025-15603

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh, startwindows.ba...

CVE-2024-57854

Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's built-in rand function, which is not suitable fo...

EUVD-2024-55467

Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's built-in rand function, which is not suitable fo...

CVE-2024-57854

Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's built-in rand function, which is not suitable fo...

CVE-2026-3255 HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function

HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand function. The HTTP::Session2 session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epo...

CVE-2026-3255

HTTP::Session2 (Perl) vulnerable in versions before 1.12, where the session-id generator creates a SHA-1 hash seeded with the built-in rand() output, epoch time, and the process ID. The PID comes from a small set of numbers, and the epoch time may be guessed if not leaked via HTTP Date. rand() is...

Linux Distros Unpatched Vulnerability : CVE-2026-2966

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mgsendnsreq of the file /src/dns.c of the component DNS...

CVE-2026-2966 Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values

A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mgsendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. Executing a manipulation of the argument random can lead to insufficiently random values. The attack can be launched...