Skip to content
Noroxi

CWE-338 · 193 records

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CVEs in this class

193 records

  • CVE-2008-0166
    51Plan

    OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable

    HighCVSS 7.5Proof of conceptEPSS 70%

    openssl · opensslMay 13, 2008

  • CVE-2009-2367
    46Plan

    cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and

    CriticalCVSS 9.8WeaponizedEPSS 23%

    iomega · storcenter pro firmwareJul 8, 2009

  • CVE-2021-43799
    41Plan

    RabbitMQ exposes ports with weak default secrets in Zulip Server

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    zulip · zulipJan 25, 2022

  • CVE-2019-16303
    40Plan

    A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of

    CriticalCVSS 9.8No exploitEPSS 3%

    jhipster · jhipsterSep 13, 2019

  • CVE-2020-28642
    40Plan

    In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote atta

    CriticalCVSS 9.8No exploitEPSS 2%

    infinitewp · infinitewpNov 15, 2020

  • CVE-2017-18021
    40Plan

    It was discovered that QtPass before 1.2.1, when using the built-in password generator, generates possibly predictable and enumerable passwo

    CriticalCVSS 9.8No exploitEPSS 2%

    qtpass · qtpassJan 5, 2018

  • CVE-2021-3538
    40Plan

    A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7

    CriticalCVSS 9.8No exploitEPSS 2%

    satori · uuidJun 2, 2021

  • CVE-2015-9435
    40Plan

    The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.

    CriticalCVSS 9.8No exploitEPSS 2%

    dash10 · oauth serverSep 25, 2019

  • CVE-2011-4574
    39Monitor

    PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm.

    CriticalCVSS 9.8No exploitEPSS 1%

    polarssl · polarsslOct 26, 2021

  • CVE-2024-40762
    39Monitor

    Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain ca

    CriticalCVSS 9.8No exploitEPSS 1%

    sonicwall · sonicosJan 9, 2025

  • CVE-2023-36993
    39Monitor

    The cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset function allows an attac

    CriticalCVSS 9.8No exploitEPSS 0%

    travianz project · travianzJul 7, 2023

  • CVE-2022-44796
    39Monitor

    An issue was discovered in Object First Ootbi BETA build 1.0.7.712.

    CriticalCVSS 9.8No exploitEPSS 0%

    objectfirst · ootbiNov 7, 2022

  • CVE-2025-3495
    39Monitor

    COMMGR - Insufficient Randomization Authentication Bypass

    CriticalCVSS 9.8No exploitEPSS 0%

    delta electronics · commgrApr 15, 2025

  • CVE-2026-3256
    39Monitor

    HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids

    CriticalCVSS 9.8No exploitEPSS 0%

    ktat · http\Mar 28, 2026

  • CVE-2025-59390
    39Monitor

    Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    apache · druidNov 26, 2025

  • CVE-2026-16235
    39Monitor

    Crypt::Password versions through 0.28 for Perl generate insecure random values for salts

    CriticalCVSS 9.8No exploitEPSS 0%

    drsteve · crypt::passwordJul 20, 2026

  • CVE-2026-56141
    39Monitor

    In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predict

    CriticalCVSS 9.8No exploitEPSS 0%

    jetbrains · hubJun 19, 2026

  • CVE-2025-15604
    39Monitor

    Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions

    CriticalCVSS 9.8No exploitEPSS 0%

    tokuhirom · amon2Mar 28, 2026

  • CVE-2026-25726
    39Monitor

    Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)

    CriticalCVSS 9.8No exploitEPSS 0%

    cloudreve · cloudreveApr 3, 2026

  • CVE-2026-2439
    39Monitor

    Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids

    CriticalCVSS 9.8No exploitEPSS 0%

    bva · concierge\Feb 16, 2026

  • CVE-2025-40926
    39Monitor

    Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely

    CriticalCVSS 9.8No exploitEPSS 0%

    kazeburo · plack\Mar 4, 2026

  • CVE-2025-15578
    39Monitor

    Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely

    CriticalCVSS 9.8No exploitEPSS 0%

    teejay · maypoleFeb 16, 2026

  • CVE-2026-9205
    39Monitor

    Langflow is affected by weaknesses in secret handling and sensitive configuration access

    CriticalCVSS 9.8No exploitEPSS 0%

    langflow · langflowAug 5, 2026

  • CVE-2026-79901
    39Monitor

    Predictable Active Directory service-account passwords in BoKS Manager

    CriticalCVSS 9.9No exploitEPSS 0%

    fortra · boks manager boks-serverOct 1, 2026

  • GHSA-rc7v-65v6-m2v3
    39Monitor

    Withdrawn Advisory: go-mysql affected by go.uuid's Predictable UUID Identifiers

    CriticalCVSS 9.8No exploit

    Go · github.com/go-mysql-org/go-mysqlOct 28, 2024

All vulnerability classes