Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Every one of the 35 is a mark on the map. Named now: 1 to 26, most at risk first.

1. An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session…CVE-2018-12520Ntop · 10% likely

   Ntop

2. An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding.CVE-2016-10180Dlink · CVSS 7.5 · 4.5% likely

   D-Link

3. steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data.CVE-2021-27211Steghide Project · 3.4% likely
4. Insecure random number generationCVE-2021-41117juliangruber · CVSS 8.7 · 3.2% likely

   Juliangruber

5. passwd_recovery.lua on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin password by leveraging a predictable random number generator seed. This is fixed i…CVE-2017-11519Tp-Link · 3.1% likely

   TP-Link

6. IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple ICC instances are loaded which could r…CVE-2018-1426IBM · CVSS 7.4 · 2.4% likely

   IBM

7. In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now() to seed the PRNG which results in a small se…CVE-2019-11495Couchbase · 2.1% likely

   Couchbase

8. The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate pass…CVE-2019-25061Random Password Generator Project · 1.9% likely
9. In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG has a 48-bit seed t…CVE-2019-10908Airsonic Project · 1.6% likely
10. lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.CVE-2012-1577dietlibc · 1.6% likely
11. When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the…CVE-2018-12384NSS · 1.5% likely
12. Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Sta…CVE-2020-7010Elastic · 1.4% likely

    Elastic

13. Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output c…CVE-2016-3735Piwigo · 1.4% likely

    Piwigo

14. D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator.CVE-2020-13784Dlink · 1.3% likely

    D-Link

15. An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.CVE-2024-27632Gnu · CVSS 8.8 · 1.3% likely

    GNU

16. The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows prediction of a uniqid value based on knowledge of a time value. This makes it easier to re…CVE-2017-5214Codextrous · 1.2% likely
17. QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to se…CVE-2024-36048Qt · CVSS 9.8 · 1.0% likely

    Qt

18. Random number seed fixed during compilationCVE-2022-39218fastly · CVSS 7.5 · 0.9% likely

    Fastly

19. Apache Cocoon: continuations may not be privateCVE-2025-24783Apache Software Foundation · CVSS 7.5 · 0.8% likely

    Apache

20. D-Link COVR 1200,1202,1203 v1.08 was discovered to have a predictable seed in a Pseudo-Random Number Generator.CVE-2022-42159Dlink · CVSS 4.3 · 0.8% likely

    D-Link

21. Cryptographically weak PRNG in Opinio 7.22CVE-2023-4472Objectplanet · CVSS 9.8 · 0.7% likely

    Objectplanet

22. NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7Dl9#dj- string) and…CVE-2025-27580NIH · CVSS 7.5 · 0.7% likely

    Nih

23. Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations. The time value used by the device can be se…CVE-2021-32033Protectimus · 0.5% likely
24. Insufficient seeding of random number generatorCVE-2024-1579Secomea · CVSS 8.1 · 0.5% likely

    Secomea

25. Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processesCVE-2026-11702DAVIDO · CVSS 7.5 · 0.5% likely
26. Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processesCVE-2026-11625DAVIDO · CVSS 7.5 · 0.5% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.