Common Weakness Enumeration
CWE-338
AllowedUse of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Abstraction: Base · Status: Draft
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
149 vulnerabilities reference this CWE, most recent first.
CVE-2026-125362 (GCVE-0-2026-125362)
Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
EPSS
VEX
Title
Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint
Summary
Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.
Severity
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/haiwen/seahub/issues/9687 | issue-tracking |
| https://github.com/haiwen/seahub | product |
| https://github.com/haiwen/seahub/blob/v14.0.10-pr… | technical-description |
| https://github.com/haiwen/seahub/commit/dd3ba0341… | patch |
| https://www.vulncheck.com/advisories/seahub-throu… | third-party-advisory |
Date Public
2026-10-28 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "seahub",
"vendor": "haiwen",
"versions": [
{
"lessThanOrEqual": "14.0.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python\u0027s non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users\u0027 share link passwords."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:27:35.716Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #9687",
"tags": [
"issue-tracking"
],
"url": "https://github.com/haiwen/seahub/issues/9687"
},
{
"tags": [
"product"
],
"url": "https://github.com/haiwen/seahub"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/haiwen/seahub/blob/v14.0.10-pro/seahub/api2/endpoints/multi_share_links.py#L502-L512"
},
{
"tags": [
"patch"
],
"url": "https://github.com/haiwen/seahub/commit/dd3ba0341031fd29cabe4855b548badde861df52"
},
{
"name": "VulnCheck Advisory: Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/seahub-through-14.0.10-predictable-share-link-passwords-via-batch-endpoint"
}
],
"title": "Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125362",
"datePublished": "2026-11-09T23:27:35.716Z",
"dateReserved": "2026-11-09T22:03:00.945Z",
"dateUpdated": "2026-11-09T23:27:35.716Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121553 (GCVE-0-2026-121553)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:17 – Updated: 2026-11-07 03:09
VLAI
EPSS
VEX
Title
Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())
Summary
Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control.
Severity
4.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 03:09 UTC
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1904 | issue-tracking |
| https://github.com/Cotonti/Cotonti | product |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/mod… | technical-description |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/mod… | technical-description |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/mod… | technical-description |
| https://github.com/Cotonti/Cotonti/pull/1905 | technical-descriptionpatchissue-tracking |
| https://www.vulncheck.com/advisories/cotonti-thro… | third-party-advisory |
Impacted products
Date Public
2026-09-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121553",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T03:09:24.645106Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:09:49.080Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1904"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "cotonti",
"vendor": "cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sun Kimsroul"
}
],
"datePublic": "2026-09-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:17:11.513Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1904",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1904"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.functions.php#L97"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.profile.php#L116"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.register.php#L148"
},
{
"tags": [
"technical-description",
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1905"
},
{
"name": "VulnCheck Advisory: Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-through-1.0.0-predictable-validation-tokens-via-md5-microtime"
}
],
"title": "Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121553",
"datePublished": "2026-11-03T15:17:11.513Z",
"dateReserved": "2026-11-03T14:46:15.628Z",
"dateUpdated": "2026-11-07T03:09:49.080Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118986 (GCVE-0-2026-118986)
Vulnerability from cvelistv5 – Published: 2026-10-30 13:13 – Updated: 2026-11-06 16:46
VLAI
EPSS
VEX
Title
CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()
Summary
CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().
The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline.
An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 16:46 UTC
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
CPANSec
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://metacpan.org/release/OETIKER/CallBackery-… | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-118986",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:46:13.642574Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:46:47.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"CallBackery"
],
"packageName": "CallBackery",
"packageURL": "pkg:cpan/CallBackery",
"programFiles": [
"lib/CallBackery/Config.pm"
],
"programRoutines": [
{
"name": "CallBackery::Config::secretFile"
},
{
"name": "CallBackery::Config::reConfigure"
}
],
"repo": "https://github.com/oetiker/callbackery",
"versions": [
{
"lessThan": "0.62.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().\n\nThe secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline.\n\nAn attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:13:32.845Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to CallBackery 0.62.0 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-118986",
"datePublished": "2026-10-30T13:13:32.845Z",
"dateReserved": "2026-10-29T10:48:23.002Z",
"dateUpdated": "2026-11-06T16:46:47.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112240 (GCVE-0-2026-112240)
Vulnerability from cvelistv5 – Published: 2026-10-20 09:30 – Updated: 2026-10-20 16:13
VLAI
EPSS
VEX
Title
Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
Summary
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 16:13 UTC
CWE
Assigner
TYPO3
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "TYPO3 Fluid-Form by coding.ms" |
Affected:
6.0.0 , < 6.0.6
(semver)
Affected: 0 , < 5.0.10 (semver) |
Date Public
2026-10-20 09:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112240",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T16:13:09.787826Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:13:19.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "codingms/fluid-form",
"product": "Extension \"TYPO3 Fluid-Form by coding.ms\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "6.0.6",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThan": "5.0.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Thomas Deuling"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Thomas Deuling"
}
],
"datePublic": "2026-10-20T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email."
}
],
"value": "The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-338",
"description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T09:30:51.530Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-033"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Broken Access Control in extension \"TYPO3 Fluid-Form by coding.ms\" (fluid_form)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-112240",
"datePublished": "2026-10-20T09:30:51.530Z",
"dateReserved": "2026-10-19T11:29:08.878Z",
"dateUpdated": "2026-10-20T16:13:19.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112041 (GCVE-0-2026-112041)
Vulnerability from cvelistv5 – Published: 2026-10-19 02:00 – Updated: 2026-10-19 17:48
VLAI
EPSS
VEX
Title
diem-project diem dmString.php random weak prng
Summary
A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This vulnerability affects the function dmString::random of the file dmCorePlugin/lib/basic/dmString.php. Such manipulation leads to cryptographically weak prng. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:48 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421689 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421689/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112041 | third-party-advisory |
| https://vuldb.com/submit/1008084 | third-party-advisory |
| https://github.com/diem-project/diem/issues/458 | exploitissue-tracking |
| https://github.com/diem-project/diem/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| diem-project | diem |
Affected:
116974edfb9a5b8bd69cb13586dc62bcdbb485ad
cpe:2.3:a:diem-project:diem:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112041",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:48:22.548079Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:48:35.750Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:diem-project:diem:*:*:*:*:*:*:*:*"
],
"product": "diem",
"vendor": "diem-project",
"versions": [
{
"status": "affected",
"version": "116974edfb9a5b8bd69cb13586dc62bcdbb485ad"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cnluminous (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This vulnerability affects the function dmString::random of the file dmCorePlugin/lib/basic/dmString.php. Such manipulation leads to cryptographically weak prng. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "Cryptographically Weak PRNG",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-331",
"description": "Insufficient Entropy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T02:00:21.063Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421689 | diem-project diem dmString.php random weak prng",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421689"
},
{
"name": "VDB-421689 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421689/cti"
},
{
"name": "CVE-2026-112041 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112041"
},
{
"name": "Submit #1008084 | diem-project diem 116974edfb9a5b8bd69cb13586dc62bcdbb485ad Cryptographically Weak PRNG",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1008084"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/diem-project/diem/issues/458"
},
{
"tags": [
"product"
],
"url": "https://github.com/diem-project/diem/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T11:57:53.000Z",
"value": "VulDB entry last update"
}
],
"title": "diem-project diem dmString.php random weak prng",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112041",
"datePublished": "2026-10-19T02:00:21.063Z",
"dateReserved": "2026-10-18T09:52:22.316Z",
"dateUpdated": "2026-10-19T17:48:35.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107612 (GCVE-0-2026-107612)
Vulnerability from cvelistv5 – Published: 2026-10-08 13:39 – Updated: 2026-10-08 14:02
VLAI
EPSS
VEX
Title
World-accessible IPC shared memory with predictable name in TightVNC Server
Summary
Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:01 UTC
CWE
Assigner
securin
CNA
References
2 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/vnc-tight/bugs/1658/ | issue-tracking |
| https://www.tightvnc.com/whatsnew.php | release-notespatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:01:50.062814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:02:27.703Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TightVNC Server (desktop server IPC)"
],
"platforms": [
"Windows"
],
"product": "TightVNC",
"programFiles": [
"SharedMemory.cpp",
"DesktopServerWatcher.cpp"
],
"programRoutines": [
{
"name": "DesktopServerWatcher::execute()"
}
],
"vendor": "GlavSoft",
"versions": [
{
"lessThan": "2.8.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:39:55.702Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "TightVNC bug #1658",
"tags": [
"issue-tracking"
],
"url": "https://sourceforge.net/p/vnc-tight/bugs/1658/"
},
{
"name": "TightVNC release notes (2.8.88)",
"tags": [
"release-notes",
"patch"
],
"url": "https://www.tightvnc.com/whatsnew.php"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade TightVNC for Windows to version 2.8.88 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T00:00:00.000Z",
"value": "Reported to GlavSoft"
},
{
"lang": "en",
"time": "2026-06-02T00:00:00.000Z",
"value": "Vendor acknowledged"
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "TightVNC 2.8.88 released with fix"
}
],
"title": "World-accessible IPC shared memory with predictable name in TightVNC Server"
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-107612",
"datePublished": "2026-10-08T13:39:55.702Z",
"dateReserved": "2026-10-08T13:23:07.677Z",
"dateUpdated": "2026-10-08T14:02:27.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107283 (GCVE-0-2026-107283)
Vulnerability from cvelistv5 – Published: 2026-10-07 21:24 – Updated: 2026-10-08 14:00
VLAI
EPSS
VEX
Title
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
Summary
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest relies on an unpredictable cnonce to resist chosen-plaintext and credential precomputation attacks, so an observer able to infer generator state can reduce the protection of the authentication exchange. This issue is fixed in versions 3.0.12 and 2.16.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:00 UTC
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
GitHub_M
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/AsyncHttpClient/async-http-cli… | x_refsource_CONFIRM |
| https://github.com/AsyncHttpClient/async-http-cli… | x_refsource_MISC |
| https://github.com/AsyncHttpClient/async-http-cli… | x_refsource_MISC |
| https://github.com/AsyncHttpClient/async-http-cli… | x_refsource_MISC |
| https://github.com/AsyncHttpClient/async-http-cli… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AsyncHttpClient | async-http-client |
Affected:
>= 3.0.0, < 3.0.12
Affected: >= 2.0.0, < 2.16.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107283",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:00:11.700421Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:00:20.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "async-http-client",
"vendor": "AsyncHttpClient",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.0.12"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2.16.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest relies on an unpredictable cnonce to resist chosen-plaintext and credential precomputation attacks, so an observer able to infer generator state can reduce the protection of the authentication exchange. This issue is fixed in versions 3.0.12 and 2.16.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T21:24:56.640Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-mfj3-87qq-382v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-mfj3-87qq-382v"
},
{
"name": "https://github.com/AsyncHttpClient/async-http-client/commit/dca2d90db87f0144ea893a6858dca13c426d06b6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/AsyncHttpClient/async-http-client/commit/dca2d90db87f0144ea893a6858dca13c426d06b6"
},
{
"name": "https://github.com/AsyncHttpClient/async-http-client/commit/e1f5fc88fe211d3f64032c33b91093ba3d5e793d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/AsyncHttpClient/async-http-client/commit/e1f5fc88fe211d3f64032c33b91093ba3d5e793d"
},
{
"name": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1"
},
{
"name": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.12"
}
],
"source": {
"advisory": "GHSA-mfj3-87qq-382v",
"discovery": "UNKNOWN"
},
"title": "AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107283",
"datePublished": "2026-10-07T21:24:56.640Z",
"dateReserved": "2026-10-07T15:53:23.586Z",
"dateUpdated": "2026-10-08T14:00:20.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104356 (GCVE-0-2026-104356)
Vulnerability from cvelistv5 – Published: 2026-10-01 21:21 – Updated: 2026-11-08 14:00 X_Open Source
VLAI
EPSS
VEX
Title
PictShare < 3.7.1 Predictable Delete Code via rand()
Summary
PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-02 18:23 UTC
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/HaschekSolutions/pictshare/com… | issue-trackingrelease-notespatch |
| https://github.com/HaschekSolutions/pictshare/rel… | patchrelease-notes |
| https://www.vulncheck.com/advisories/pictshare-pr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HaschekSolutions | pictshare |
Affected:
2.0.0 , < 3.7.1
(semver)
cpe:2.3:a:hascheksolutions:pictshare:*:*:*:*:*:*:*:* |
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104356",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-02T18:23:52.166713Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T18:24:02.153Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/HaschekSolutions/pictshare",
"product": "pictshare",
"repo": "https://github.com/HaschekSolutions/pictshare",
"vendor": "HaschekSolutions",
"versions": [
{
"lessThan": "3.7.1",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:hascheksolutions:pictshare:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.7.1",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alisher Qarshibayev"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulnCheck"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T14:00:47.293Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"issue-tracking",
"release-notes",
"patch"
],
"url": "https://github.com/HaschekSolutions/pictshare/commit/ce5fc474e89769efeae25fee763894bcce3412e3"
},
{
"name": "pictshare 3.7.1 Release Notes",
"tags": [
"patch",
"release-notes"
],
"url": "https://github.com/HaschekSolutions/pictshare/releases/tag/v3.7.1"
},
{
"name": "VulnCheck Advisory",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pictshare-predictable-delete-code-via-rand"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "PictShare \u003c 3.7.1 Predictable Delete Code via rand()",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-104356",
"datePublished": "2026-10-01T21:21:45.992Z",
"dateReserved": "2026-10-01T20:48:03.271Z",
"dateUpdated": "2026-11-08T14:00:47.293Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102813 (GCVE-0-2026-102813)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:40 – Updated: 2026-11-04 16:59
VLAI
EPSS
VEX
Title
Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305
Summary
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password.
Successful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 16:58 UTC
CWE
- CWE-338 - Use of cryptographically weak Pseudo-Random number generator (PRNG)
Assigner
TPLink
CNA
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/download/re305… | patch |
| https://www.tp-link.com/en/support/download/re305… | patch |
| https://www.tp-link.com/us/support/faq/5362/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | RE305 v3 |
Affected:
0 , < 1.1.8 Build 20260921 Rel. 42853
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102813",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T16:58:28.914160Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T16:59:22.544Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RE305 v3",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.8 Build 20260921 Rel. 42853",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Victor Mota"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003eAn authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password.\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eSuccessful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions.\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password.\u00a0\n\n\n\n\n\nSuccessful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions."
}
],
"impacts": [
{
"capecId": "CAPEC-50",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-50 Password Recovery Exploitation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338 Use of cryptographically weak Pseudo-Random number generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:40:31.857Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/re305/v3/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/re305/v3/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5362/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-102813",
"datePublished": "2026-10-27T17:40:31.857Z",
"dateReserved": "2026-09-29T17:18:44.961Z",
"dateUpdated": "2026-11-04T16:59:22.544Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102719 (GCVE-0-2026-102719)
Vulnerability from cvelistv5 – Published: 2026-09-29 17:45 – Updated: 2026-11-04 09:36
VLAI
EPSS
VEX
Title
NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check
Summary
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server fills HelloVerifyRequest cookies from NX_RAND(), by default the C library rand(), with no key and no binding to the client. An attacker who can predict the generator's output can pass the cookie exchange from a spoofed address and make the server send its handshake flight to a victim, using it as a traffic reflector.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 18:39 UTC
CWE
- CWE-338 - Use of cryptographically weak Pseudo-Random number generator (PRNG)
Assigner
eclipse
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse ThreadX NetX Duo |
Affected:
6.0 , ≤ 6.5.2.202603a
(custom)
Unaffected: 6.5.2.202603b (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102719",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T18:39:04.305372Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T18:39:25.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eclipse ThreadX NetX Duo",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "6.5.2.202603a",
"status": "affected",
"version": "6.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.5.2.202603b",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "afldl"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Fr\u00e9d\u00e9ric Desbiens"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server fills HelloVerifyRequest cookies from NX_RAND(), by default the C library rand(), with no key and no binding to the client. An attacker who can predict the generator\u0027s output can pass the cookie exchange from a spoofed address and make the server send its handshake flight to a victim, using it as a traffic reflector.\u003c/p\u003e"
}
],
"value": "In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server fills HelloVerifyRequest cookies from NX_RAND(), by default the C library rand(), with no key and no binding to the client. An attacker who can predict the generator\u0027s output can pass the cookie exchange from a spoofed address and make the server send its handshake flight to a victim, using it as a traffic reflector."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338 Use of cryptographically weak Pseudo-Random number generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T09:36:15.185Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-j6gx-3j6v-3hm4"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-102719",
"datePublished": "2026-09-29T17:45:21.609Z",
"dateReserved": "2026-09-29T16:15:15.514Z",
"dateUpdated": "2026-11-04T09:36:15.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
Use functions or hardware which use a hardware-based random number generation for all crypto. This is the recommended solution. Use CyptGenRandom on Windows, or hw_rand() on Linux.
No CAPEC attack patterns related to this CWE.