CWE-340 · Cryptography
Generation of Predictable Numbers or Identifiers
64CVEs
SortMost likely exploited
64 CVEs with CWE-340 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-118527In CISA KEVExploitedUse of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content…Ivanti · Connect Secure · CVSS 4.3 · 2026-11-03 | 4.3 | 0.8% | 2026-11-03 |
| CVE-2026-11374Account Takeover via Predictable SSO Ticket Generationzohocorp · manageengine_adselfservice_plus · CVSS 9 · 2026-06-23 | 9.0 | 2.5% | 2026-06-23 |
| CVE-2024-47945Predictable Session IDRITTAL GmbH & Co. KG · IoT Interface & CMC III Processing Unit · CVSS 9.1 · 2024-10-15 | 9.1 | 0.9% | 2024-10-15 |
| CVE-2025-69286RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerabilityinfiniflow · ragflow · CVSS 8.9 · 2025-12-31 | 8.9 | 0.8% | 2025-12-31 |
| CVE-2024-28957Generation of predictable identifiers issue exists in Cente middleware TCP/IP Network Series. If this vulnerability is exploited, a remote unauthenticated attacker may interfere c…DMG MORI Digital Co., LTD. and NEXT Co., Ltd. · Cente TCP/IPv4 · CVSS 5.3 · 2024-04-15 | 5.3 | 0.8% | 2024-04-15 |
| CVE-2024-12274BookingPress < 1.1.23 - Unauthenticated Export File DownloadCodepeople · Appointment Booking Calendar Plugin and Scheduling Plugin · CVSS 7.5 · 2025-01-13 | 7.5 | 0.6% | 2025-01-13 |
| CVE-2025-40931Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session idCHORNY · Apache::Session::Generate::MD5 · CVSS 9.1 · 2026-03-05 | 9.1 | 0.6% | 2026-03-05 |
| CVE-2020-1905Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have allowed a malicious thi…Facebook · WhatsApp for Android · 2020-10-06 | – | 0.6% | 2020-10-06 |
| CVE-2024-6477UsersWP < 1.2.12 - Users Information DisclosureAyecode · UsersWP · CVSS 7.5 · 2024-08-03 | 7.5 | 0.6% | 2024-08-03 |
| CVE-2026-13577Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailableNo vendor recorded · CVSS 8.2 · 2026-07-20 | 8.2 | 0.6% | 2026-07-20 |
| CVE-2026-95653Concrete CMS Community Store before 2.7.8 Predictable Digital Download Tokenconcretecms-community-store · community_store · CVSS 7.5 · 2026-09-22 | 7.5 | 0.6% | 2026-09-22 |
| CVE-2026-3256HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session idsKTAT · HTTP::Session · CVSS 9.8 · 2026-03-28 | 9.8 | 0.5% | 2026-03-28 |
| CVE-2025-15604Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functionsTOKUHIROM · Amon2 · CVSS 9.8 · 2026-03-28 | 9.8 | 0.5% | 2026-03-28 |
| CVE-2025-10148predictable WebSocket maskcurl · curl · CVSS 5.3 · 2025-09-12 | 5.3 | 0.5% | 2025-09-12 |
| CVE-2024-52299The PDF viewer macro allows accessing any attachment without access right checksxwikisas · macro-pdfviewer · CVSS 7.5 · 2024-11-13 | 7.5 | 0.5% | 2024-11-13 |
| CVE-2026-9733Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameterHAYAJO · Mojolicious::Plugin::Web::Auth::OAuth2 · CVSS 9.1 · 2026-06-23 | 9.1 | 0.5% | 2026-06-23 |
| CVE-2026-56016CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sourcesMARKSTOS · CGI::Session::ID::md5 · CVSS 5.9 · 2026-07-01 | 5.9 | 0.5% | 2026-07-01 |
| CVE-2026-2473Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.Google Cloud · Vertex AI Experiments · CVSS 7.7 · 2026-02-20 | 7.7 | 0.5% | 2026-02-20 |
| CVE-2025-40926Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurelyKAZEBURO · Plack::Middleware::Session::Simple · CVSS 9.8 · 2026-03-05 | 9.8 | 0.5% | 2026-03-05 |
| CVE-2025-40920Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated noncesETHER · Catalyst::Authentication::Credential::HTTP · CVSS 8.6 · 2025-08-11 | 8.6 | 0.5% | 2025-08-11 |
| CVE-2026-2439Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session idsBVA · Concierge::Sessions · CVSS 9.8 · 2026-02-16 | 9.8 | 0.5% | 2026-02-16 |
| CVE-2025-14602Weak File Name Generation in vsDeskvsDesk · vsDesk · CVSS 5.3 · 2026-08-20 | 5.3 | 0.5% | 2026-08-20 |
| CVE-2026-3255HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() functionTOKUHIROM · HTTP::Session2 · CVSS 6.5 · 2026-02-27 | 6.5 | 0.5% | 2026-02-27 |
| CVE-2025-40918Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurelyEHUELS · Authen::SASL::Perl::DIGEST_MD5 · CVSS 6.5 · 2025-07-16 | 6.5 | 0.5% | 2025-07-16 |
| CVE-2026-5083Ado::Sessions versions through 0.935 for Perl generates insecure session idsBEROV · Ado::Sessions · CVSS 5.3 · 2026-04-08 | 5.3 | 0.4% | 2026-04-08 |
| CVE-2025-59452The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that beg…YoSmart · YoLink API · CVSS 5.8 · 2025-10-06 | 5.8 | 0.4% | 2025-10-06 |
| CVE-2026-5082Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session idTOKUHIROM · Amon2::Plugin::Web::CSRFDefender · CVSS 5.3 · 2026-04-08 | 5.3 | 0.4% | 2026-04-08 |
| CVE-2026-9692Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurelyHAYAJO · Mojolicious::Sessions::Storable · CVSS 5.3 · 2026-06-18 | 5.3 | 0.4% | 2026-06-18 |
| CVE-2025-40933Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurelyKGOLDOV · Apache::AuthAny · CVSS 7.5 · 2025-09-17 | 7.5 | 0.4% | 2025-09-17 |
| CVE-2026-40496FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Forcefreescout-help-desk · freescout · CVSS 8.8 · 2026-04-21 | 8.8 | 0.4% | 2026-04-21 |
| CVE-2026-75106OpnForm Editable Submission Secret Derivation via Empty Hashids SaltOpnForm · OpnForm · CVSS 9.1 · 2026-08-17 | 9.1 | 0.4% | 2026-08-17 |
| CVE-2025-40923Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurelyMIYAGAWA · Plack::Middleware::Session · CVSS 7.3 · 2025-07-16 | 7.3 | 0.4% | 2025-07-16 |
| CVE-2026-64964Generation of Predictable Email Confirmation Token in ATutorATutor · ATutor · CVSS 6.3 · 2026-08-20 | 6.3 | 0.4% | 2026-08-20 |
| CVE-2026-5080Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurelyBIGPRESH · Dancer::Session::Abstract · CVSS 5.9 · 2026-04-30 | 5.9 | 0.4% | 2026-04-30 |
| CVE-2025-40925Starch versions 0.14 and earlier generate session ids insecurelyBLUEFEET · Starch · CVSS 9.1 · 2025-09-20 | 9.1 | 0.4% | 2025-09-20 |
| CVE-2026-107242The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is comple…Versa · VOS · CVSS 9.1 · 2026-11-10 | 9.1 | 0.4% | 2026-11-10 |
| CVE-2026-63170Omnispace Agora Project 26.10.0 Predictable Share Token via md5IdOmnispace · Agora Project · CVSS 3.7 · 2026-11-13 | 3.7 | 0.4% | 2026-11-13 |
| CVE-2026-9219Setracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or IdentifiersShenzhen i365-Tech Co. Ltd. · Setracker2 Parental Control App (Android) package com.tgelec.setracker · CVSS 6.5 · 2026-06-25 | 6.5 | 0.3% | 2026-06-25 |
| CVE-2024-12034Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblockwebfactory · Advanced Google reCAPTCHA · CVSS 5.3 · 2024-12-24 | 5.3 | 0.3% | 2024-12-24 |
| CVE-2026-5085Solstice::Session versions through 1440 for Perl generates session ids insecurelyMCRAWFOR · Solstice::Session · CVSS 9.1 · 2026-04-13 | 9.1 | 0.3% | 2026-04-13 |
| CVE-2026-46346Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Resetintranda · goobi-viewer-core · CVSS 6.5 · 2026-10-23 | 6.5 | 0.3% | 2026-10-23 |
| CVE-2026-5084WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurelyASPEER · WebDyne::Session · CVSS 6.5 · 2026-05-11 | 6.5 | 0.3% | 2026-05-11 |
| CVE-2025-62294Predictable Generation of Password Recovery TokenSOPlanning · SOPlanning · CVSS 8.7 · 2025-11-20 | 8.7 | 0.3% | 2025-11-20 |
| CVE-2026-45673Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Portnetty · netty · CVSS 6.8 · 2026-06-12 | 6.8 | 0.3% | 2026-06-12 |
| CVE-2026-85297Bucket Squatting in Cloud Run MCP leads to Service Account TakeoverGoogle Cloud · Cloud Run MCP · CVSS 7.7 · 2026-10-26 | 7.7 | 0.3% | 2026-10-26 |
| CVE-2026-5081Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecureCHORNY · Apache::Session::Generate::ModUniqueId · CVSS 9.1 · 2026-05-06 | 9.1 | 0.3% | 2026-05-06 |
| CVE-2025-40919Authen::DigestMD5 versions 0.01 through 0.04 for Perl generate the cnonce insecurelySALVA · Authen::DigestMD5 · CVSS 6.5 · 2025-07-16 | 6.5 | 0.3% | 2025-07-16 |
| CVE-2025-40924Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurelyHAARG · Catalyst::Plugin::Session · CVSS 6.5 · 2025-07-17 | 6.5 | 0.3% | 2025-07-17 |
| CVE-2026-47085An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's accou…cyrusimap · Cyrus IMAP · CVSS 4 · 2026-07-16 | 4.0 | 0.3% | 2026-07-16 |
| CVE-2026-4269Improper S3 ownership verification in Bedrock AgentCore Starter ToolkitAWS · Bedrock AgentCore Starter Toolkit · CVSS 7.5 · 2026-03-16 | 7.5 | 0.3% | 2026-03-16 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.