CWE-341 · Cryptography
Predictable from Observable State
15CVEs
SortMost likely exploited
15 CVEs with CWE-341 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2019-6563Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a full compromise of…ICS-CERT · Moxa IKS, EDS · 2019-03-05 | – | 1.7% | 2019-03-05 |
| CVE-2020-1731A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when installing Keycloak, how…Red Hat · keycloak · CVSS 9.1 · 2020-03-02 | 9.1 | 1.3% | 2020-03-02 |
| CVE-2018-17917All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potential Cloud IDs. Using this ID, the attack…Hangzhou Xiongmai Technology Co., Ltd · XMeye P2P Cloud Server · 2018-10-10 | – | 1.3% | 2018-10-10 |
| CVE-2020-5365Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. The pre-configured support account, remotesupport, is bundled in the Dell EMC Isilon OneFS instal…Dell · Isilon OneFS · CVSS 5.3 · 2020-05-20 | 5.3 | 1.0% | 2020-05-20 |
| CVE-2024-10141jsbroks COCO Annotator Session predictable statejsbroks · COCO Annotator · CVSS 3.7 · 2024-10-19 | 3.7 | 0.8% | 2024-10-19 |
| CVE-2026-38968ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-…Ntop · Ntopng · CVSS 9.8 · 2026-07-02 | 9.8 | 0.6% | 2026-07-02 |
| CVE-2021-4277fredsmith utils Filename screenshot_sync predictable statefredsmith · utils · CVSS 2.6 · 2022-12-25 | 2.6 | 0.5% | 2022-12-25 |
| CVE-2025-48461Weak Session Cookie EntropyAdvantech · Advantech Wireless Sensing and Equipment (WISE) · CVSS 5 · 2025-06-24 | 5.0 | 0.5% | 2025-06-24 |
| CVE-2025-40780Cache poisoning due to weak PRNGISC · BIND 9 · CVSS 8.6 · 2025-10-22 | 8.6 | 0.5% | 2025-10-22 |
| CVE-2026-19565Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKeyNo vendor recorded · CVSS 3.7 · 2026-08-23 | 3.7 | 0.4% | 2026-08-23 |
| CVE-2026-15571Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc clientRed Hat · Red Hat build of Keycloak 26.6 · CVSS 7.3 · 2026-08-18 | 7.3 | 0.4% | 2026-08-18 |
| CVE-2026-42365GeoVision LPC2011/LPC2211 Web Interface guessable session cookie vulnerabilityGeoVision Inc. · GV-LPC2011/LPC2211 · CVSS 8.6 · 2026-05-04 | 8.6 | 0.3% | 2026-05-04 |
| CVE-2023-49259Bruteforcing authentication cookie for a given userHongdian · H8951-4G-ESP · CVSS 7.5 · 2024-01-12 | 7.5 | 0.3% | 2024-01-12 |
| CVE-2025-42925Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)SAP_SE · SAP NetWeaver AS Java (IIOP Service) · CVSS 4.3 · 2025-09-09 | 4.3 | 0.3% | 2025-09-09 |
| CVE-2026-36609Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined with the…No vendor recorded · CVSS 7.3 · 2026-06-03 | 7.3 | 0.2% | 2026-06-03 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.