EUVD-2026-84347

Privilege escalation due to weak configuration during package extraction process...

CVE-2025-36084: Use of a Broken or Risky Cryptographic Algorithm

IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2026-25264: Uncontrolled Search Path Element

Privilege escalation due to weak configuration during package extraction process...

Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure.

A flaw was found in Spring Boot. The $random.value property source utilizes a weak pseudo-random number generator PRNG, meaning the values it produces are not sufficiently random for use as cryptographic secrets. An attacker could potentially predict these values, which may lead to information...

CVE-2026-94107: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substrmd5mtrand, 0, 10. Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG via the users.passrecover.php process. An attacker can reset any account password, including administrators, by precomputing candidate tokens within a narrow time window...

CVE-2026-93868 Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...

CVE-2026-93868 Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...

CVE-2026-93868 Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...

CVE-2026-85497

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable acro...

CVE-2026-85497 CareCam CM2507 Use of Password Hash With Insufficient Computational Effort

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable acro...

CVE-2026-85497

CareCam CM2507 IP cameras store the root-account password using a fixed legacy hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database can recover the credential, which may be reusable across other devices running the same fi...

CVE-2026-71851

A flaw was found in crypto-js. The CryptoJS.lib.WordArray.random function, used for generating cryptographic secrets, employs a weak pseudorandom number generator instead of a cryptographically secure source. This significantly reduces the randomness of generated values, such as those used for...

CVE-2026-81946 PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

CVE-2026-81946 PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

CVE-2026-81946

The PLANET IGS-5225-8P2T4S industrial managed switch (V1 and V2) uses MD5-based password hashing in firmware versions prior to 1.2412b260707 (V1) and 2.2412b260519 (V2). Because MD5 is a cryptographically weak algorithm, an attacker who obtains the device configuration file can recover the privil...

BIT-DOTNET-2025-7326 EOL ASP.NET Core Elevation of Privilege Vulnerability

Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life EOL software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry...

BIT-DOTNET-SDK-2025-7326 EOL ASP.NET Core Elevation of Privilege Vulnerability

Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life EOL software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry...

BIT-ASPNET-CORE-2025-7326 EOL ASP.NET Core Elevation of Privilege Vulnerability

Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life EOL software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry...

CVE-2026-93868: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...