Insufficient Entropy

Every one of the 128 is a mark on the map. Named now: 1 to 26, most at risk first.

1. The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; a…CVE-2008-144795% likely
2. DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplet…CVE-2018-1832654% likely
3. DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.CVE-2018-1581247% likely
4. Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions.CVE-2023-38357Rws · 5.3% likely
5. ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the te…CVE-2015-34055.3% likely
6. The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conver…CVE-2008-21084.3% likely
7. hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate…CVE-2019-100643.9% likely
8. An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently random number generation for the web interfa…CVE-2017-13992LOYTEC LVIS-3ME · 3.5% likely
9. The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy o…CVE-2019-158473.2% likely
10. node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.CVE-2015-8851node-uuid · CVSS 7.5 · 2.3% likely
11. D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropyCVE-2025-6931D-Link · CVSS 3.7 · 2.2% likely

    D-Link

12. Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy WeaknessCVE-2013-2260Cryptocat · 2.2% likely

    Cryptocat

13. Apache OpenOffice Weak Master KeysCVE-2022-37401Apache Software Foundation · 1.9% likely

    Apache

14. Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.CVE-2019-148061.9% likely
15. totd 1.5.3 uses a fixed UDP source port in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to prevent traffic injection…CVE-2022-34294Totd Project · 1.9% likely
16. wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces. This allows a remote attacker to compute the long term private key from several hund…CVE-2019-143171.8% likely
17. Rancher: Non-random authentication tokenCVE-2022-43755SUSE · CVSS 7.1 · 1.7% likely

    SUSE

18. reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover.CVE-2020-127351.7% likely
19. Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be abl…CVE-2018-10006201.7% likely
20. ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 uses insufficiently random data to (1) generate session tokens for HSMs using the C rand fun…CVE-2001-09501.6% likely
21. The web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient…CVE-2014-84221.6% likely
22. Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker may exploit this vulnerability by forging…CVE-2021-36294Dell · CVSS 9.8 · 1.6% likely

    Dell

23. Post Oak Bluetooth Traffic Systems Insufficient EntropyCVE-2012-4687Post Oak Traffic Systems · CVSS 7.6 · 1.5% likely
24. Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.CVE-2015-77641.5% likely
25. Session / Password / Password token leakCVE-2020-1773OTRS AG · CVSS 7.3 · 1.5% likely

    OTRS AG

26. Insufficient randomness in github.com/Masterminds/goutilsCVE-2021-4238github.com/Masterminds/goutils · CVSS 9.1 · 1.4% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.