CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs session cookies is built from two cal...

CVE-2026-118986

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). Th

来源摘录 · NVD

An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local ne...

CVE-2026-102813

An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interfac

历史摘要 · 未重新核验 · NVD

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing...

CVE-2026-112240

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the requ

历史摘要 · 未重新核验 · NVD

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString...

CVE-2026-104356

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the no

历史摘要 · 未重新核验 · GitHub Advisory

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code a...

CVE-2026-104356

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the no

历史摘要 · 未重新核验 · NVD

PictShare < 3.7.1 Predictable Delete Code via rand()

CVE-2026-104356

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the no

历史摘要 · 未重新核验 · OSV.dev

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed wit...

CVE-2026-53953

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versio

历史摘要 · 未重新核验 · NVD

Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or pass...

CVE-2026-9864

Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account

历史摘要 · 未重新核验 · NVD

In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence see...

CVE-2026-79901

In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-accoun

历史摘要 · 未重新核验 · NVD

Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorizatio...

CVE-2026-94456

Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The

历史摘要 · 未重新核验 · NVD

Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

CVE-2026-94456

Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The

历史摘要 · 未重新核验 · OSV.dev

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten...

CVE-2026-94107

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that gene

历史摘要 · 未重新核验 · GitHub Advisory

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10)....

CVE-2026-94107

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that gene

历史摘要 · 未重新核验 · NVD

NivoCart through 2.4.0 Predictable Administrator Password Reset Token

CVE-2026-94107

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that gene

历史摘要 · 未重新核验 · OSV.dev

Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users...

CVE-2026-93868

Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creati

历史摘要 · 未重新核验 · GitHub Advisory

Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million...

CVE-2026-93868

Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creati

历史摘要 · 未重新核验 · NVD

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthent...

CVE-2026-92749

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, all

历史摘要 · 未重新核验 · NVD

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in,...

CVE-2026-92298

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and camp

历史摘要 · 未重新核验 · GitHub Advisory

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator...

CVE-2026-92298

该漏洞影响 EspoCRM 10.0.8 及之前的所有版本。EspoCRM 是一款开源的客户关系管理（CRM）与销售自动化平台，广泛用于线索管理、营销活动和客户互动。问题根源在于：系统在三个业务场景中——潜在客户线索捕获（lead-capt

历史摘要 · 未重新核验 · NVD

Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

gorilla/websocket used `math/rand` (cryptographically weak pseudo-random number generator) to generate WebSocket frame m

历史摘要 · 未重新核验 · GitHub Advisory