CWE-330: Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- sanko net::bittorrentNet::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG5.9 Medium
- zohocorp manageengine adselfservice plus, manageengine adaudit plus, manageengine m365 manager plus +1 more +3 moreAccount Takeover via Predictable SSO Ticket Generation9.0 Critical
- nettyNetty QUIC stateless reset token material exposed through header-visible connection IDs4.8 Medium
- spring amqp, vmware spring advanced message queuing protocol +1 moreIn Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues4.4 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Predictable Session ID in WebSocket Module4.8 Medium
- adguard adguardhomeAdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle6.3 Medium
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 morePermissive TrustAllCerts TLS Verification9.2 Critical
- netty netty-incubator-codec-ohttpnetty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures6.9 Medium
- imagemagickImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage6.3 Medium
- netatalkPredictable afpd session token6.5 Medium
- inducer relateRELATE: Predictable Token Generation in auth.py and exam.py8.7 High
- openmage magento-ltsMagento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs9.3 Critical
- chatchat-space langchain-chatchatchatchat-space Langchain-Chatchat Uploaded File openai_routes.py _get_file_id random values2.1 Low
- spring boot, vmware spring boot, red hat hawtio hawtio 4.4.0 +14 more +16 moreSpring Boot's random value property source uses a weak PRNG unsuitable for secrets4.8 Medium
- freescoutFreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force8.8 High
- dnnsoftware dotnetnuke, dnn.platform +1 moreDNN has same HostGUID for all new installs6.9 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS has Weak REST API Key Generation (Predictable)7.5 High
- openclawOpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter6.0 Medium
- jahlives openssl encryptopenssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection8.7 High
- No product listedAn issue in Eufy Homebase 2 version 3.3.4.1h allows a local attacker to obtain sensitive...7.7 High
- anhui seeker electronic technology co., ltd. xikestor sks8310-8x, seekswan zikestor sks8310-8x firmware +1 moreXikeStor SKS8310-8X Predictable Session Identifiers8.6 High
- cisco adaptive security appliance software, secure firewall adaptive security appliance (asa) software, secure firewall threat defense (ftd) software +1 more +3 moreA vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA...8.6 High
- gradio-app gradioGradio has Open Redirect in OAuth Flow4.3 Medium
- shenzhen hongyavision technology co., ltd. (sodola networks) sodola sl902-swtgw124as, sodola-network sl902-swtgw124as firmware +1 moreSODOLA SL902-SWTGW124AS <= 200.1.20 Predictable Session ID9.3 Critical
- fleetdm fleetFleet: Device lock PIN can be predicted if lock time is known0.6 Low
- freescoutFreeScout's Predictable Authentication Token Enables Account Takeover9.8 Critical
- piwigoPiwigo's secret key can be brute forced2.7 Low
- binardat ltd. 10g08-0800gsm network switch, binardat 10g08-0800gsm firmware +1 moreBinardat 10G08-0800GSM Network Switch Predictable Session Identifiers9.3 Critical
- automattic mongooseCesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values6.3 Medium
openclawnpmOpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing7.1 High- solax power pocket wifi 3.0, pocket wifi 4.0, pocket wifi+4gm +2 more +4 moreInsecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud Connection6.5 Medium
- nerves-hub nerveshub, nerves hub web +1 moreNervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute Force9.5 Critical
triton-vmcrates.ioTriton VM has a Soundness Vulnerability due to Improper Sampling of Randomness1.7 Low- samrocketman jervisJervis has a Weak Random for Timing Attack Mitigation8.2 High
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposure6.5 Medium
- libtpms project libtpmslibtpms returns wrong initialization vector when certain symmetric ciphers are used5.5 Medium
- webfactory login lockdown & protectionLogin Lockdown & Protection <= 2.14 - IP Block Bypass5.3 Medium
- ezcast pro iiPredictable Default Wi-Fi Password in EZCast Pro II Dongle9.3 Critical
- nextcloud calendar, kiteworks security-advisories +1 moreNextcloud Calendar app used predictable proposal participant tokens4.8 Medium
- cloudflare gokeygokey allows secret recovery from a seed file without the master password7.1 High
- technitium dnsserverAn issue in Technitium through v13.2.2 enables attackers to conduct a DNS cache poisoning attack...7.5 High
- asus routerAn authentication bypass vulnerability has been identified in the IFTTT integration feature. A...7.5 High
- ribose rnpRNP 0.18.0 Vulnerable PKESK session keys7.7 High
- themefic hydra booking — appointment scheduling & booking calendarHydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generat…5.3 Medium
- oatpp oatpp-mcpReuse of session IDs in oatpp-mcp leads to session hijacking and prompt hijacking by remote attackers6.8 Medium
- specialk banhammer – monitor site traffic, block bad users and botsBanhammer – Monitor Site Traffic, Block Bad Users and Bots <= 3.4.8 - Unauthenticated Protection Mechanism Bypass5.3 Medium
- youth-is-as-pale-as-poetry e-learningyouth-is-as-pale-as-poetry e-learning JWT Token JwtUtils.java encryptSecret random values6.3 Medium
form-datanpm,agama-web-uiopenSUSE,js-jqueryAzure Linux +7 more +9 moreUsage of unsafe random function in form-data for choosing boundary9.4 Critical- d-link dcs-6517, dcs-7517, dlink dcs-6517 firmware +1 more +3 moreD-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropy6.3 Medium
- vantage6Vantage6 Server JWT secret not cryptographically secure1.7 Low
- Show moreLoading…