CWE-331 in Cryptography
- CVEs
- 128
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2024-25730Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, resulting in insufficient entropy (only… | Hitrontech · Coda-4582u Firmware | Unlikely | 9.8 | 0.9% | 2024-02-23 |
| CVE-2020-29505Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Key Management Error Vulnerability. | Dell · Dell BSAFE Crypto-C Micro Edition | Unlikely | 7.1 | 0.8% | 2022-07-11 |
| CVE-2015-3006Junos: QFX Series: Insufficient entropy on QFX3500 and QFX3600 platforms when the system boots up | Juniper · Junos | Unlikely | 6.5 | 0.8% | 2020-02-28 |
| CVE-2024-53522Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components. This allows attackers to acce… | – | Unlikely | 7.5 | 0.8% | 2025-01-07 |
| CVE-2023-31582jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less. | Jose4j Project · Jose4j | Unlikely | – | 0.8% | 2023-10-24 |
| CVE-2024-36400nano-id is unable to generate the correct character set | viz-rs · nano-id | Unlikely | 9.4 | 0.8% | 2024-06-04 |
| CVE-2023-46648Insufficient Entropy in GitHub Enterprise Server Management Console Invitation Token | GitHub · Enterprise Server | Unlikely | 8.3 | 0.7% | 2023-12-21 |
| CVE-2026-90562LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key | langbot-app · LangBot | Unlikely | 8.1 | 0.7% | 2026-09-13 |
| CVE-2024-3411Insufficient Randomness When Validating an IPMI Authenticated Session | Dell · iDRAC8 | Unlikely | 9.1 | 0.7% | 2024-04-30 |
| CVE-2023-4344Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection | Broadcom · LSI Storage Authority (LSA) | Unlikely | 9.8 | 0.7% | 2023-08-15 |
| CVE-2024-6508Openshift-console: oauth2 insufficient state parameter entropy | Red Hat · Red Hat OpenShift Container Platform 4.12 | Unlikely | 8.0 | 0.7% | 2024-08-21 |
| CVE-2026-7210The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | Python Software Foundation · CPython | Unlikely | 6.3 | 0.7% | 2026-05-11 |
| CVE-2026-38447osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client… | – | Unlikely | 9.8 | 0.7% | 2026-08-03 |
| CVE-2020-36925Arteco Web Client DVR/NVR Session ID Brute Force Authentication Bypass | Arteco-Global · Arteco Web Client DVR/NVR | Unlikely | 9.8 | 0.7% | 2026-01-06 |
| CVE-2026-13639An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attacker… | Synology · DiskStation Manager (DSM) | Unlikely | 9.8 | 0.7% | 2026-09-18 |
| CVE-2023-28395 | ProPump and Controls, Inc. · Osprey Pump Controller | Unlikely | 8.3 | 0.6% | 2023-03-28 |
| CVE-2024-8796Insufficient Default OTP Shared Secret Length | devise-two-factor · devise-two-factor | Unlikely | 5.3 | 0.6% | 2024-09-17 |
| CVE-2025-47781Rallly Insufficient Password Login Token Entropy Leads to Account Takeover | lukevella · rallly | Unlikely | 9.8 | 0.6% | 2025-05-14 |
| CVE-2021-42138A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine. | Thales CPL · Safenet Authentication Service | Unlikely | 7.2 | 0.6% | 2021-12-20 |
| CVE-2025-52464Meshtastic Repeated Public and Private Keypairs | meshtastic · firmware | Unlikely | 9.5 | 0.6% | 2025-06-19 |
| CVE-2024-25407SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. This vulnerability can allow attackers to cause a Denial of Service (DoS… | Steve-Community · Steve | Unlikely | 7.5 | 0.6% | 2024-02-13 |
| CVE-2025-67504WBCE CMS has Weak Random Number Generator in Password Generation Function | WBCE · WBCE_CMS | Unlikely | 9.1 | 0.6% | 2025-12-09 |
| CVE-2026-71851crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain | brix · crypto-js | Unlikely | 9.0 | 0.5% | 2026-08-07 |
| CVE-2017-2625It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use infor… | Xorg · libXdmcp | Unlikely | 6.5 | 0.5% | 2018-07-27 |
| CVE-2026-11403Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation | Sonatype · Nexus Repository Manager | Unlikely | 8.7 | 0.5% | 2026-07-14 |
| CVE-2023-36610The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other… | Ovarro · TBox MS-CPU32 | Unlikely | 5.9 | 0.5% | 2023-07-03 |
| CVE-2026-62646A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an algorithm with insufficient randomness, resulting in a toke… | Siemens · Reyrolle 7SR5 | Unlikely | 7.4 | 0.5% | 2026-09-08 |
| CVE-2026-19906pkp pkp-lib API Key Generation APIProfileForm.php setData entropy | pkp · pkp-lib | Unlikely | 3.7 | 0.5% | 2026-08-15 |
| CVE-2026-19748Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy | Tenda · CH7 | Unlikely | 3.7 | 0.5% | 2026-08-13 |
| CVE-2023-34973QTS, QuTS hero | QNAP Systems Inc. · QTS | Unlikely | 3.1 | 0.5% | 2023-08-24 |
| CVE-2017-2626It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information ava… | Xorg · libICE | Unlikely | 5.2 | 0.5% | 2018-07-27 |
| CVE-2021-31798The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain conditions a local malicious user can obtain the… | Cyberark · Credential Provider | Unlikely | – | 0.4% | 2021-09-02 |
| CVE-2026-27490Combodo iTop: Weak secret generation for inline image | Combodo · iTop | Unlikely | 7.5 | 0.4% | 2026-08-21 |
| CVE-2025-54885Thinbus generates insufficient entropy: 252 bits vs minimum 256 bits | simbo1905 · thinbus-srp-npm | Unlikely | 6.9 | 0.4% | 2025-08-07 |
| CVE-2026-46473Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand | TCHATZI · Authen::TOTP | Unlikely | 7.5 | 0.4% | 2026-05-21 |
| CVE-2016-2858QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request,… | Qemu · Qemu | Unlikely | – | 0.4% | 2016-04-07 |
| CVE-2026-41080libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. | libexpat project · libexpat | Unlikely | 2.9 | 0.4% | 2026-04-16 |
| CVE-2021-3505A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in t… | Libtpms Project · libtpms | Unlikely | – | 0.4% | 2021-04-19 |
| CVE-2020-11957The Bluetooth Low Energy implementation in Cypress PSoC Creator BLE 4.2 component versions before 3.64 generates a random number (Pairing Random) with significantly less entropy t… | Cypress · Psoc 4.2 Ble | Unlikely | – | 0.4% | 2020-06-09 |
| CVE-2022-34746An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 series firmware versi… | Zyxel · Zyxel GS1900 series firmware | Unlikely | 5.9 | 0.4% | 2022-09-20 |
| CVE-2025-29311Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack. Attackers are able to leverage this vulnerability into… | Opennetworking · Onos | Unlikely | 7.5 | 0.4% | 2025-03-24 |
| CVE-2025-15387QNO Technology｜VPN Firewall - Insufficient Entropy | QNO Technology · VPN Firewall | Unlikely | 8.8 | 0.4% | 2025-12-31 |
| CVE-2026-42155Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs | OpenMage · magento-lts | Unlikely | 9.3 | 0.4% | 2026-05-15 |
| CVE-2026-8700Crypt::DSA versions before 1.20 for Perl generate seeds using rand | TIMLEGGE · Crypt::DSA | Unlikely | 7.3 | 0.4% | 2026-05-15 |
| CVE-2021-31797The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition, leading to password disclosure. | Cyberark · Credential Provider | Unlikely | – | 0.3% | 2021-09-01 |
| CVE-2025-15629Weak Session Key Generation in TP-Link Omada Adoption Protocol | TP-Link Systems Inc. · Omada Gateways | Unlikely | 6.9 | 0.3% | 2026-08-03 |
| CVE-2025-14261Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privileges | Litmuschaos · litmus | Unlikely | 7.1 | 0.3% | 2025-12-08 |
| CVE-2026-46474Trog::TOTP versions before 1.006 for Perl generate secrets using rand | TEODESIAN · Trog::TOTP | Unlikely | 7.5 | 0.3% | 2026-05-15 |
| CVE-2026-4827Insufficient Entropy vulnerability on Multiple Products | Schneider Electric · Easergy MiCOM C264 | Unlikely | 8.7 | 0.3% | 2026-05-12 |
| CVE-2026-22698RustCrypto SM2-PKE has 32-bit Biased Nonce Vulnerability | RustCrypto · elliptic-curves | Unlikely | 8.7 | 0.3% | 2026-01-10 |
Data as of 2026-11-15.