Generation of Predictable Numbers or Identifiers

Every one of the 64 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content…CVE-2026-118527Ivanti · CVSS 4.3 · 0.8% likelycovered by CyberSIXT

   IvantiUTA05768 articles

2. Account Takeover via Predictable SSO Ticket GenerationCVE-2026-11374zohocorp · CVSS 9 · 2.5% likelycovered by CyberSIXT

   Zoho (ManageEngine)

3. Predictable Session IDCVE-2024-47945RITTAL GmbH & Co. KG · CVSS 9.1 · 0.9% likely
4. RAGFlow has Predictable Token Generation Leading to Authentication Bypass VulnerabilityCVE-2025-69286infiniflow · CVSS 8.9 · 0.8% likely

   InfiniFlow

5. Generation of predictable identifiers issue exists in Cente middleware TCP/IP Network Series. If this vulnerability is exploited, a remote unauthenticated attacker may interfere c…CVE-2024-28957DMG MORI Digital Co., LTD. and NEXT Co., Ltd. · CVSS 5.3 · 0.8% likely
6. BookingPress < 1.1.23 - Unauthenticated Export File DownloadCVE-2024-12274Codepeople · CVSS 7.5 · 0.6% likely

   Codepeople

7. Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session idCVE-2025-40931CHORNY · CVSS 9.1 · 0.6% likely
8. Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have allowed a malicious thi…CVE-2020-1905Facebook · 0.6% likely

   Meta (Facebook)

9. UsersWP < 1.2.12 - Users Information DisclosureCVE-2024-6477Ayecode · CVSS 7.5 · 0.6% likely

   AyeCode Ltd

10. Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailableCVE-2026-13577CVSS 8.2 · 0.6% likely
11. Concrete CMS Community Store before 2.7.8 Predictable Digital Download TokenCVE-2026-95653concretecms-community-store · CVSS 7.5 · 0.6% likely
12. HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session idsCVE-2026-3256KTAT · CVSS 9.8 · 0.5% likely
13. Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functionsCVE-2025-15604TOKUHIROM · CVSS 9.8 · 0.5% likely

    TOKUHIROM

14. predictable WebSocket maskCVE-2025-10148curl · CVSS 5.3 · 0.5% likely

    The Curl Project1 bounty report

15. The PDF viewer macro allows accessing any attachment without access right checksCVE-2024-52299xwikisas · CVSS 7.5 · 0.5% likely

    Xwikisas

16. Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameterCVE-2026-9733HAYAJO · CVSS 9.1 · 0.5% likely
17. CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sourcesCVE-2026-56016MARKSTOS · CVSS 5.9 · 0.5% likely
18. Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.CVE-2026-2473Google Cloud · CVSS 7.7 · 0.5% likely

    Google Cloud

19. Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurelyCVE-2025-40926KAZEBURO · CVSS 9.8 · 0.5% likely
20. Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated noncesCVE-2025-40920ETHER · CVSS 8.6 · 0.5% likely

    ETHER

21. Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session idsCVE-2026-2439BVA · CVSS 9.8 · 0.5% likely
22. Weak File Name Generation in vsDeskCVE-2025-14602vsDesk · CVSS 5.3 · 0.5% likely

    vsDesk

23. HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() functionCVE-2026-3255TOKUHIROM · CVSS 6.5 · 0.5% likely

    TOKUHIROM

24. Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurelyCVE-2025-40918EHUELS · CVSS 6.5 · 0.5% likely
25. Ado::Sessions versions through 0.935 for Perl generates insecure session idsCVE-2026-5083BEROV · CVSS 5.3 · 0.4% likely
26. The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that beg…CVE-2025-59452YoSmart · CVSS 5.8 · 0.4% likely

    YoSmart

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.