Common Weakness Enumeration
CWE-330
DiscouragedUse of Insufficiently Random Values
Abstraction: Class · Status: Stable
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
444 vulnerabilities reference this CWE, most recent first.
CVE-2026-23999 (GCVE-0-2026-23999)
Vulnerability from cvelistv5 – Published: 2026-02-26 02:45 – Updated: 2026-02-26 15:15
VLAI
EPSS
VEX
Title
Fleet: Device lock PIN can be predicted if lock time is known
Summary
Fleet is open source device management software. In versions prior to 4.80.1, Fleet generated device lock and wipe PINs using a predictable algorithm based solely on the current Unix timestamp. Because no secret key or additional entropy was used, the resulting PIN could potentially be derived if the approximate time the device was locked is known. Fleet’s device lock and wipe commands generate a 6-digit PIN that is displayed to administrators for unlocking a device. In affected versions, this PIN was deterministically derived from the current timestamp. An attacker with physical possession of a locked device and knowledge of the approximate time the lock command was issued could theoretically predict the correct PIN within a limited search window. However, successful exploitation is constrained by multiple factors: Physical access to the device is required, the approximate lock time must be known, the operating system enforces rate limiting on PIN entry attempts, attempts would need to be spread over, and device wipe operations would typically complete before sufficient attempts could be made. As a result, this issue does not allow remote exploitation, fleet-wide compromise, or bypass of Fleet authentication controls. Version 4.80.1 contains a patch. No known workarounds are available.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/fleetdm/fleet/security/advisor… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23999",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-26T15:15:42.627648Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T15:15:55.289Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fleet",
"vendor": "fleetdm",
"versions": [
{
"status": "affected",
"version": "\u003c 4.80.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Fleet is open source device management software. In versions prior to 4.80.1, Fleet generated device lock and wipe PINs using a predictable algorithm based solely on the current Unix timestamp. Because no secret key or additional entropy was used, the resulting PIN could potentially be derived if the approximate time the device was locked is known. Fleet\u2019s device lock and wipe commands generate a 6-digit PIN that is displayed to administrators for unlocking a device. In affected versions, this PIN was deterministically derived from the current timestamp. An attacker with physical possession of a locked device and knowledge of the approximate time the lock command was issued could theoretically predict the correct PIN within a limited search window. However, successful exploitation is constrained by multiple factors: Physical access to the device is required, the approximate lock time must be known, the operating system enforces rate limiting on PIN entry attempts, attempts would need to be spread over, and device wipe operations would typically complete before sufficient attempts could be made. As a result, this issue does not allow remote exploitation, fleet-wide compromise, or bypass of Fleet authentication controls. Version 4.80.1 contains a patch. No known workarounds are available."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "PHYSICAL",
"baseScore": 0.6,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330: Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T02:45:48.099Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/fleetdm/fleet/security/advisories/GHSA-ppwx-5jq7-px2w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-ppwx-5jq7-px2w"
}
],
"source": {
"advisory": "GHSA-ppwx-5jq7-px2w",
"discovery": "UNKNOWN"
},
"title": "Fleet: Device lock PIN can be predicted if lock time is known"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-23999",
"datePublished": "2026-02-26T02:45:48.099Z",
"dateReserved": "2026-01-19T18:49:20.658Z",
"dateUpdated": "2026-02-26T15:15:55.289Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-21444 (GCVE-0-2026-21444)
Vulnerability from cvelistv5 – Published: 2026-01-02 19:05 – Updated: 2026-01-05 20:37
VLAI
EPSS
VEX
Title
libtpms returns wrong initialization vector when certain symmetric ciphers are used
Summary
libtpms, a library that provides software emulation of a Trusted Platform Module, has a flaw in versions 0.10.0 and 0.10.1. The commonly used integration of libtpms with OpenSSL 3.x contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality. Version 0.10.2 fixes the issue. No known workarounds are available.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/stefanberger/libtpms/security/… | x_refsource_CONFIRM |
| https://github.com/stefanberger/libtpms/issues/541 | x_refsource_MISC |
| https://github.com/stefanberger/libtpms/commit/33… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| stefanberger | libtpms |
Affected:
>= 0.10.0, < 0.10.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-21444",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-05T20:30:19.842839Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T20:37:42.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "libtpms",
"vendor": "stefanberger",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.10.0, \u003c 0.10.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "libtpms, a library that provides software emulation of a Trusted Platform Module, has a flaw in versions 0.10.0 and 0.10.1. The commonly used integration of libtpms with OpenSSL 3.x contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality. Version 0.10.2 fixes the issue. No known workarounds are available."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-327",
"description": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330: Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-02T19:05:31.503Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/stefanberger/libtpms/security/advisories/GHSA-7jxr-4j3g-p34f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/stefanberger/libtpms/security/advisories/GHSA-7jxr-4j3g-p34f"
},
{
"name": "https://github.com/stefanberger/libtpms/issues/541",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/stefanberger/libtpms/issues/541"
},
{
"name": "https://github.com/stefanberger/libtpms/commit/33c9ff074cb16c1841ce7d7f33643c17c426743a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/stefanberger/libtpms/commit/33c9ff074cb16c1841ce7d7f33643c17c426743a"
}
],
"source": {
"advisory": "GHSA-7jxr-4j3g-p34f",
"discovery": "UNKNOWN"
},
"title": "libtpms returns wrong initialization vector when certain symmetric ciphers are used"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-21444",
"datePublished": "2026-01-02T19:05:31.503Z",
"dateReserved": "2025-12-29T03:00:29.276Z",
"dateUpdated": "2026-01-05T20:37:42.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-20101 (GCVE-0-2026-20101)
Vulnerability from cvelistv5 – Published: 2026-03-04 17:19 – Updated: 2026-03-05 15:33
VLAI
EPSS
VEX
Summary
A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
This vulnerability is due to insufficient error checking when processing SAML messages. An attacker could exploit this vulnerability by sending crafted SAML messages to the SAML service. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Secure Firewall Adaptive Security Appliance (ASA) Software |
Affected:
9.12.1
Affected: 9.12.1.2 Affected: 9.12.1.3 Affected: 9.12.2 Affected: 9.12.2.4 Affected: 9.12.2.5 Affected: 9.12.2.9 Affected: 9.12.3 Affected: 9.12.3.2 Affected: 9.12.3.7 Affected: 9.12.4 Affected: 9.12.3.12 Affected: 9.12.3.9 Affected: 9.12.2.1 Affected: 9.12.4.2 Affected: 9.12.4.4 Affected: 9.12.4.7 Affected: 9.12.4.10 Affected: 9.12.4.13 Affected: 9.12.4.8 Affected: 9.12.4.18 Affected: 9.12.4.24 Affected: 9.12.4.26 Affected: 9.12.4.29 Affected: 9.12.4.30 Affected: 9.12.4.35 Affected: 9.12.4.37 Affected: 9.12.4.38 Affected: 9.12.4.39 Affected: 9.12.4.40 Affected: 9.12.4.41 Affected: 9.12.4.47 Affected: 9.12.4.48 Affected: 9.12.4.50 Affected: 9.12.4.52 Affected: 9.12.4.54 Affected: 9.12.4.55 Affected: 9.12.4.56 Affected: 9.12.4.58 Affected: 9.12.4.62 Affected: 9.12.4.65 Affected: 9.12.4.67 Affected: 9.16.1 Affected: 9.16.1.28 Affected: 9.16.2 Affected: 9.16.2.3 Affected: 9.16.2.7 Affected: 9.16.2.11 Affected: 9.16.2.13 Affected: 9.16.2.14 Affected: 9.16.3 Affected: 9.16.3.3 Affected: 9.16.3.14 Affected: 9.16.3.15 Affected: 9.16.3.19 Affected: 9.16.3.23 Affected: 9.16.4 Affected: 9.16.4.9 Affected: 9.16.4.14 Affected: 9.16.4.19 Affected: 9.16.4.27 Affected: 9.16.4.38 Affected: 9.16.4.39 Affected: 9.16.4.42 Affected: 9.16.4.48 Affected: 9.16.4.55 Affected: 9.16.4.57 Affected: 9.16.4.61 Affected: 9.16.4.62 Affected: 9.16.4.67 Affected: 9.16.4.70 Affected: 9.16.4.71 Affected: 9.16.4.76 Affected: 9.16.4.82 Affected: 9.16.4.84 Affected: 9.17.1 Affected: 9.17.1.7 Affected: 9.17.1.9 Affected: 9.17.1.10 Affected: 9.17.1.11 Affected: 9.17.1.13 Affected: 9.17.1.15 Affected: 9.17.1.20 Affected: 9.17.1.30 Affected: 9.17.1.33 Affected: 9.17.1.39 Affected: 9.17.1.45 Affected: 9.17.1.46 Affected: 9.18.1 Affected: 9.18.1.3 Affected: 9.18.2 Affected: 9.18.2.5 Affected: 9.18.2.7 Affected: 9.18.2.8 Affected: 9.18.3 Affected: 9.18.3.39 Affected: 9.18.3.46 Affected: 9.18.3.53 Affected: 9.18.3.55 Affected: 9.18.3.56 Affected: 9.18.4 Affected: 9.18.4.5 Affected: 9.18.4.8 Affected: 9.18.4.22 Affected: 9.18.4.24 Affected: 9.18.4.29 Affected: 9.18.4.34 Affected: 9.18.4.40 Affected: 9.18.4.47 Affected: 9.18.4.50 Affected: 9.18.4.52 Affected: 9.18.4.53 Affected: 9.18.4.57 Affected: 9.19.1 Affected: 9.19.1.5 Affected: 9.19.1.9 Affected: 9.19.1.12 Affected: 9.19.1.18 Affected: 9.19.1.22 Affected: 9.19.1.24 Affected: 9.19.1.27 Affected: 9.19.1.28 Affected: 9.19.1.31 Affected: 9.19.1.37 Affected: 9.19.1.38 Affected: 9.19.1.42 Affected: 9.20.1 Affected: 9.20.1.5 Affected: 9.20.2 Affected: 9.20.2.10 Affected: 9.20.2.21 Affected: 9.20.2.22 Affected: 9.20.3 Affected: 9.20.3.4 Affected: 9.20.3.7 Affected: 9.20.3.9 Affected: 9.20.3.10 Affected: 9.20.3.13 Affected: 9.20.3.16 Affected: 9.20.3.20 Affected: 9.22.1.1 Affected: 9.22.1.3 Affected: 9.22.1.2 Affected: 9.22.1.6 Affected: 9.22.2 Affected: 9.23.1 Affected: 9.23.1.3 |
|
| Cisco | Cisco Secure Firewall Threat Defense (FTD) Software |
Affected:
6.4.0
Affected: 6.4.0.1 Affected: 6.4.0.3 Affected: 6.4.0.2 Affected: 6.4.0.4 Affected: 6.4.0.5 Affected: 6.4.0.6 Affected: 6.4.0.7 Affected: 6.4.0.8 Affected: 6.4.0.9 Affected: 6.4.0.10 Affected: 6.4.0.11 Affected: 6.4.0.12 Affected: 6.4.0.13 Affected: 6.4.0.14 Affected: 6.4.0.15 Affected: 6.4.0.16 Affected: 6.4.0.17 Affected: 6.4.0.18 Affected: 7.0.0 Affected: 7.0.0.1 Affected: 7.0.1 Affected: 7.0.1.1 Affected: 7.0.2 Affected: 7.0.2.1 Affected: 7.0.3 Affected: 7.0.4 Affected: 7.0.5 Affected: 7.0.6 Affected: 7.0.6.1 Affected: 7.0.6.2 Affected: 7.0.6.3 Affected: 7.0.7 Affected: 7.0.8 Affected: 7.0.8.1 Affected: 7.1.0 Affected: 7.1.0.1 Affected: 7.1.0.2 Affected: 7.1.0.3 Affected: 7.2.0 Affected: 7.2.0.1 Affected: 7.2.1 Affected: 7.2.2 Affected: 7.2.3 Affected: 7.2.4 Affected: 7.2.4.1 Affected: 7.2.5 Affected: 7.2.5.1 Affected: 7.2.6 Affected: 7.2.7 Affected: 7.2.5.2 Affected: 7.2.8 Affected: 7.2.8.1 Affected: 7.2.9 Affected: 7.2.10 Affected: 7.2.10.2 Affected: 7.3.0 Affected: 7.3.1 Affected: 7.3.1.1 Affected: 7.3.1.2 Affected: 7.4.0 Affected: 7.4.1 Affected: 7.4.1.1 Affected: 7.4.2 Affected: 7.4.2.1 Affected: 7.4.2.2 Affected: 7.4.2.3 Affected: 7.4.2.4 Affected: 7.6.0 Affected: 7.6.1 Affected: 7.6.2 Affected: 7.6.2.1 Affected: 7.7.0 Affected: 7.7.10 Affected: 7.7.10.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20101",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-05T15:33:49.065833Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-05T15:33:58.629Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "9.12.1"
},
{
"status": "affected",
"version": "9.12.1.2"
},
{
"status": "affected",
"version": "9.12.1.3"
},
{
"status": "affected",
"version": "9.12.2"
},
{
"status": "affected",
"version": "9.12.2.4"
},
{
"status": "affected",
"version": "9.12.2.5"
},
{
"status": "affected",
"version": "9.12.2.9"
},
{
"status": "affected",
"version": "9.12.3"
},
{
"status": "affected",
"version": "9.12.3.2"
},
{
"status": "affected",
"version": "9.12.3.7"
},
{
"status": "affected",
"version": "9.12.4"
},
{
"status": "affected",
"version": "9.12.3.12"
},
{
"status": "affected",
"version": "9.12.3.9"
},
{
"status": "affected",
"version": "9.12.2.1"
},
{
"status": "affected",
"version": "9.12.4.2"
},
{
"status": "affected",
"version": "9.12.4.4"
},
{
"status": "affected",
"version": "9.12.4.7"
},
{
"status": "affected",
"version": "9.12.4.10"
},
{
"status": "affected",
"version": "9.12.4.13"
},
{
"status": "affected",
"version": "9.12.4.8"
},
{
"status": "affected",
"version": "9.12.4.18"
},
{
"status": "affected",
"version": "9.12.4.24"
},
{
"status": "affected",
"version": "9.12.4.26"
},
{
"status": "affected",
"version": "9.12.4.29"
},
{
"status": "affected",
"version": "9.12.4.30"
},
{
"status": "affected",
"version": "9.12.4.35"
},
{
"status": "affected",
"version": "9.12.4.37"
},
{
"status": "affected",
"version": "9.12.4.38"
},
{
"status": "affected",
"version": "9.12.4.39"
},
{
"status": "affected",
"version": "9.12.4.40"
},
{
"status": "affected",
"version": "9.12.4.41"
},
{
"status": "affected",
"version": "9.12.4.47"
},
{
"status": "affected",
"version": "9.12.4.48"
},
{
"status": "affected",
"version": "9.12.4.50"
},
{
"status": "affected",
"version": "9.12.4.52"
},
{
"status": "affected",
"version": "9.12.4.54"
},
{
"status": "affected",
"version": "9.12.4.55"
},
{
"status": "affected",
"version": "9.12.4.56"
},
{
"status": "affected",
"version": "9.12.4.58"
},
{
"status": "affected",
"version": "9.12.4.62"
},
{
"status": "affected",
"version": "9.12.4.65"
},
{
"status": "affected",
"version": "9.12.4.67"
},
{
"status": "affected",
"version": "9.16.1"
},
{
"status": "affected",
"version": "9.16.1.28"
},
{
"status": "affected",
"version": "9.16.2"
},
{
"status": "affected",
"version": "9.16.2.3"
},
{
"status": "affected",
"version": "9.16.2.7"
},
{
"status": "affected",
"version": "9.16.2.11"
},
{
"status": "affected",
"version": "9.16.2.13"
},
{
"status": "affected",
"version": "9.16.2.14"
},
{
"status": "affected",
"version": "9.16.3"
},
{
"status": "affected",
"version": "9.16.3.3"
},
{
"status": "affected",
"version": "9.16.3.14"
},
{
"status": "affected",
"version": "9.16.3.15"
},
{
"status": "affected",
"version": "9.16.3.19"
},
{
"status": "affected",
"version": "9.16.3.23"
},
{
"status": "affected",
"version": "9.16.4"
},
{
"status": "affected",
"version": "9.16.4.9"
},
{
"status": "affected",
"version": "9.16.4.14"
},
{
"status": "affected",
"version": "9.16.4.19"
},
{
"status": "affected",
"version": "9.16.4.27"
},
{
"status": "affected",
"version": "9.16.4.38"
},
{
"status": "affected",
"version": "9.16.4.39"
},
{
"status": "affected",
"version": "9.16.4.42"
},
{
"status": "affected",
"version": "9.16.4.48"
},
{
"status": "affected",
"version": "9.16.4.55"
},
{
"status": "affected",
"version": "9.16.4.57"
},
{
"status": "affected",
"version": "9.16.4.61"
},
{
"status": "affected",
"version": "9.16.4.62"
},
{
"status": "affected",
"version": "9.16.4.67"
},
{
"status": "affected",
"version": "9.16.4.70"
},
{
"status": "affected",
"version": "9.16.4.71"
},
{
"status": "affected",
"version": "9.16.4.76"
},
{
"status": "affected",
"version": "9.16.4.82"
},
{
"status": "affected",
"version": "9.16.4.84"
},
{
"status": "affected",
"version": "9.17.1"
},
{
"status": "affected",
"version": "9.17.1.7"
},
{
"status": "affected",
"version": "9.17.1.9"
},
{
"status": "affected",
"version": "9.17.1.10"
},
{
"status": "affected",
"version": "9.17.1.11"
},
{
"status": "affected",
"version": "9.17.1.13"
},
{
"status": "affected",
"version": "9.17.1.15"
},
{
"status": "affected",
"version": "9.17.1.20"
},
{
"status": "affected",
"version": "9.17.1.30"
},
{
"status": "affected",
"version": "9.17.1.33"
},
{
"status": "affected",
"version": "9.17.1.39"
},
{
"status": "affected",
"version": "9.17.1.45"
},
{
"status": "affected",
"version": "9.17.1.46"
},
{
"status": "affected",
"version": "9.18.1"
},
{
"status": "affected",
"version": "9.18.1.3"
},
{
"status": "affected",
"version": "9.18.2"
},
{
"status": "affected",
"version": "9.18.2.5"
},
{
"status": "affected",
"version": "9.18.2.7"
},
{
"status": "affected",
"version": "9.18.2.8"
},
{
"status": "affected",
"version": "9.18.3"
},
{
"status": "affected",
"version": "9.18.3.39"
},
{
"status": "affected",
"version": "9.18.3.46"
},
{
"status": "affected",
"version": "9.18.3.53"
},
{
"status": "affected",
"version": "9.18.3.55"
},
{
"status": "affected",
"version": "9.18.3.56"
},
{
"status": "affected",
"version": "9.18.4"
},
{
"status": "affected",
"version": "9.18.4.5"
},
{
"status": "affected",
"version": "9.18.4.8"
},
{
"status": "affected",
"version": "9.18.4.22"
},
{
"status": "affected",
"version": "9.18.4.24"
},
{
"status": "affected",
"version": "9.18.4.29"
},
{
"status": "affected",
"version": "9.18.4.34"
},
{
"status": "affected",
"version": "9.18.4.40"
},
{
"status": "affected",
"version": "9.18.4.47"
},
{
"status": "affected",
"version": "9.18.4.50"
},
{
"status": "affected",
"version": "9.18.4.52"
},
{
"status": "affected",
"version": "9.18.4.53"
},
{
"status": "affected",
"version": "9.18.4.57"
},
{
"status": "affected",
"version": "9.19.1"
},
{
"status": "affected",
"version": "9.19.1.5"
},
{
"status": "affected",
"version": "9.19.1.9"
},
{
"status": "affected",
"version": "9.19.1.12"
},
{
"status": "affected",
"version": "9.19.1.18"
},
{
"status": "affected",
"version": "9.19.1.22"
},
{
"status": "affected",
"version": "9.19.1.24"
},
{
"status": "affected",
"version": "9.19.1.27"
},
{
"status": "affected",
"version": "9.19.1.28"
},
{
"status": "affected",
"version": "9.19.1.31"
},
{
"status": "affected",
"version": "9.19.1.37"
},
{
"status": "affected",
"version": "9.19.1.38"
},
{
"status": "affected",
"version": "9.19.1.42"
},
{
"status": "affected",
"version": "9.20.1"
},
{
"status": "affected",
"version": "9.20.1.5"
},
{
"status": "affected",
"version": "9.20.2"
},
{
"status": "affected",
"version": "9.20.2.10"
},
{
"status": "affected",
"version": "9.20.2.21"
},
{
"status": "affected",
"version": "9.20.2.22"
},
{
"status": "affected",
"version": "9.20.3"
},
{
"status": "affected",
"version": "9.20.3.4"
},
{
"status": "affected",
"version": "9.20.3.7"
},
{
"status": "affected",
"version": "9.20.3.9"
},
{
"status": "affected",
"version": "9.20.3.10"
},
{
"status": "affected",
"version": "9.20.3.13"
},
{
"status": "affected",
"version": "9.20.3.16"
},
{
"status": "affected",
"version": "9.20.3.20"
},
{
"status": "affected",
"version": "9.22.1.1"
},
{
"status": "affected",
"version": "9.22.1.3"
},
{
"status": "affected",
"version": "9.22.1.2"
},
{
"status": "affected",
"version": "9.22.1.6"
},
{
"status": "affected",
"version": "9.22.2"
},
{
"status": "affected",
"version": "9.23.1"
},
{
"status": "affected",
"version": "9.23.1.3"
}
]
},
{
"product": "Cisco Secure Firewall Threat Defense (FTD) Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.4.0.1"
},
{
"status": "affected",
"version": "6.4.0.3"
},
{
"status": "affected",
"version": "6.4.0.2"
},
{
"status": "affected",
"version": "6.4.0.4"
},
{
"status": "affected",
"version": "6.4.0.5"
},
{
"status": "affected",
"version": "6.4.0.6"
},
{
"status": "affected",
"version": "6.4.0.7"
},
{
"status": "affected",
"version": "6.4.0.8"
},
{
"status": "affected",
"version": "6.4.0.9"
},
{
"status": "affected",
"version": "6.4.0.10"
},
{
"status": "affected",
"version": "6.4.0.11"
},
{
"status": "affected",
"version": "6.4.0.12"
},
{
"status": "affected",
"version": "6.4.0.13"
},
{
"status": "affected",
"version": "6.4.0.14"
},
{
"status": "affected",
"version": "6.4.0.15"
},
{
"status": "affected",
"version": "6.4.0.16"
},
{
"status": "affected",
"version": "6.4.0.17"
},
{
"status": "affected",
"version": "6.4.0.18"
},
{
"status": "affected",
"version": "7.0.0"
},
{
"status": "affected",
"version": "7.0.0.1"
},
{
"status": "affected",
"version": "7.0.1"
},
{
"status": "affected",
"version": "7.0.1.1"
},
{
"status": "affected",
"version": "7.0.2"
},
{
"status": "affected",
"version": "7.0.2.1"
},
{
"status": "affected",
"version": "7.0.3"
},
{
"status": "affected",
"version": "7.0.4"
},
{
"status": "affected",
"version": "7.0.5"
},
{
"status": "affected",
"version": "7.0.6"
},
{
"status": "affected",
"version": "7.0.6.1"
},
{
"status": "affected",
"version": "7.0.6.2"
},
{
"status": "affected",
"version": "7.0.6.3"
},
{
"status": "affected",
"version": "7.0.7"
},
{
"status": "affected",
"version": "7.0.8"
},
{
"status": "affected",
"version": "7.0.8.1"
},
{
"status": "affected",
"version": "7.1.0"
},
{
"status": "affected",
"version": "7.1.0.1"
},
{
"status": "affected",
"version": "7.1.0.2"
},
{
"status": "affected",
"version": "7.1.0.3"
},
{
"status": "affected",
"version": "7.2.0"
},
{
"status": "affected",
"version": "7.2.0.1"
},
{
"status": "affected",
"version": "7.2.1"
},
{
"status": "affected",
"version": "7.2.2"
},
{
"status": "affected",
"version": "7.2.3"
},
{
"status": "affected",
"version": "7.2.4"
},
{
"status": "affected",
"version": "7.2.4.1"
},
{
"status": "affected",
"version": "7.2.5"
},
{
"status": "affected",
"version": "7.2.5.1"
},
{
"status": "affected",
"version": "7.2.6"
},
{
"status": "affected",
"version": "7.2.7"
},
{
"status": "affected",
"version": "7.2.5.2"
},
{
"status": "affected",
"version": "7.2.8"
},
{
"status": "affected",
"version": "7.2.8.1"
},
{
"status": "affected",
"version": "7.2.9"
},
{
"status": "affected",
"version": "7.2.10"
},
{
"status": "affected",
"version": "7.2.10.2"
},
{
"status": "affected",
"version": "7.3.0"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.3.1.1"
},
{
"status": "affected",
"version": "7.3.1.2"
},
{
"status": "affected",
"version": "7.4.0"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.4.1.1"
},
{
"status": "affected",
"version": "7.4.2"
},
{
"status": "affected",
"version": "7.4.2.1"
},
{
"status": "affected",
"version": "7.4.2.2"
},
{
"status": "affected",
"version": "7.4.2.3"
},
{
"status": "affected",
"version": "7.4.2.4"
},
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.6.2.1"
},
{
"status": "affected",
"version": "7.7.0"
},
{
"status": "affected",
"version": "7.7.10"
},
{
"status": "affected",
"version": "7.7.10.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition.\r\n\r This vulnerability is due to insufficient error checking when processing SAML messages. An attacker could exploit this vulnerability by sending crafted SAML messages to the SAML service. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Use of Insufficiently Random Values",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-04T17:19:22.576Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-asaftd-vpn-m9sx6MbC",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-m9sx6MbC"
}
],
"source": {
"advisory": "cisco-sa-asaftd-vpn-m9sx6MbC",
"defects": [
"CSCwo49932"
],
"discovery": "INTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20101",
"datePublished": "2026-03-04T17:19:22.576Z",
"dateReserved": "2025-10-08T11:59:15.370Z",
"dateUpdated": "2026-03-05T15:33:58.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14702 (GCVE-0-2026-14702)
Vulnerability from cvelistv5 – Published: 2026-07-05 04:00 – Updated: 2026-07-06 17:49
VLAI
EPSS
VEX
Title
zcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random values
Summary
A flaw has been found in zcaceres markdownify-mcp up to 1.1.0. This impacts the function saveToTempFile of the file src/Markdownify.ts of the component webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown. This manipulation causes insufficiently random values. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/376298 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/376298/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-14702 | third-party-advisory |
| https://vuldb.com/submit/846942 | third-party-advisory |
| https://github.com/zcaceres/markdownify-mcp/issues/110 | exploitissue-tracking |
| https://github.com/zcaceres/markdownify-mcp/pull/111 | issue-trackingpatch |
| https://github.com/zcaceres/markdownify-mcp/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zcaceres | markdownify-mcp |
Affected:
1.0
Affected: 1.1.0 cpe:2.3:a:zcaceres:markdownify-mcp:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14702",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-06T17:49:37.877689Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-06T17:49:57.657Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:zcaceres:markdownify-mcp:*:*:*:*:*:*:*:*"
],
"modules": [
"webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown"
],
"product": "markdownify-mcp",
"vendor": "zcaceres",
"versions": [
{
"status": "affected",
"version": "1.0"
},
{
"status": "affected",
"version": "1.1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem0000000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in zcaceres markdownify-mcp up to 1.1.0. This impacts the function saveToTempFile of the file src/Markdownify.ts of the component webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown. This manipulation causes insufficiently random values. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1,
"vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-310",
"description": "Cryptographic Issues",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-05T04:00:08.361Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-376298 | zcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random values",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/376298"
},
{
"name": "VDB-376298 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/376298/cti"
},
{
"name": "CVE-2026-14702 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-14702"
},
{
"name": "Submit #846942 | zcaceres markdownify-mcp / mcp-markdownify-server up to 1.1.0 CWE-59: Improper Link Resolution Before File Access (\u0027Link Follo",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/846942"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/zcaceres/markdownify-mcp/issues/110"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/zcaceres/markdownify-mcp/pull/111"
},
{
"tags": [
"product"
],
"url": "https://github.com/zcaceres/markdownify-mcp/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-04T07:33:44.000Z",
"value": "VulDB entry last update"
}
],
"title": "zcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random values"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-14702",
"datePublished": "2026-07-05T04:00:08.361Z",
"dateReserved": "2026-07-04T05:28:34.112Z",
"dateUpdated": "2026-07-06T17:49:57.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14570 (GCVE-0-2026-14570)
Vulnerability from cvelistv5 – Published: 2026-07-05 01:30 – Updated: 2026-07-06 13:42
VLAI
EPSS
VEX
Title
Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery
Summary
Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery.
"Crypt::DSA::Util::makerandom forces the high bit of every value it returns to obtain an exactly N-bit integer for prime search. The signing nonce and the private key are drawn from makerandom. Because the high bit is always set, the result is not uniform: its top bit is fixed, producing insecure values."
An attacker who collects a modest number of signatures under an affected key, together with the public key, can recover the private key with a lattice attack.
Keys used to sign with an affected version should be considered compromised and new keys should be generated.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TIMLEGGE | Crypt::DSA |
Affected:
0 , < 1.22
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-05T05:19:58.316Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/05/1"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-14570",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-06T13:41:52.097549Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-06T13:42:11.715Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"packageName": "Crypt-DSA",
"product": "Crypt::DSA",
"programFiles": [
"lib/Crypt/DSA/Util.pm",
"lib/Crypt/DSA.pm",
"lib/Crypt/DSA/KeyChain.pm"
],
"programRoutines": [
{
"name": "Crypt::DSA::Util::makerandom"
},
{
"name": "Crypt::DSA::sign"
},
{
"name": "Crypt::DSA::KeyChain::generate_keys"
}
],
"repo": "https://github.com/perl-Crypt-OpenPGP/Crypt-DSA",
"vendor": "TIMLEGGE",
"versions": [
{
"lessThan": "1.22",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery.\n\n\"Crypt::DSA::Util::makerandom forces the high bit of every value it returns to obtain an exactly N-bit integer for prime search. The signing nonce and the private key are drawn from makerandom. Because the high bit is always set, the result is not uniform: its top bit is fixed, producing insecure values.\"\n\nAn attacker who collects a modest number of signatures under an affected key, together with the public key, can recover the private key with a lattice attack.\n\nKeys used to sign with an affected version should be considered compromised and new keys should be generated."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330 Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-05T01:30:12.849Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"url": "https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.21/source/lib/Crypt/DSA/Util.pm#L56"
},
{
"url": "https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.22/diff/TIMLEGGE/Crypt-DSA-1.21#lib/Crypt/DSA/Util.pm"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.22/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to version 1.22 or later, which draws the nonce and private key uniformly via rejection sampling (Crypt::DSA::Util::randombelow) with no forced high bit.\n\nRevoke and regenerate any keys used to sign with an affected version.\n\nCrypt::DSA was deprecated in version 1.20. You should migrate to another solution."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-14570",
"datePublished": "2026-07-05T01:30:12.849Z",
"dateReserved": "2026-07-03T10:37:19.787Z",
"dateUpdated": "2026-07-06T13:42:11.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11374 (GCVE-0-2026-11374)
Vulnerability from cvelistv5 – Published: 2026-06-23 08:19 – Updated: 2026-06-24 15:48
VLAI
EPSS
VEX
Title
Account Takeover via Predictable SSO Ticket Generation
Summary
In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted
by an unauthenticated user, leading to account takeover.
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| zohocorp | manageengine_adselfservice_plus |
Affected:
0 , < 6529
(custom)
|
|
| zohocorp | manageengine_recovery_manager_plus |
Affected:
0 , < 6321
(custom)
|
|
| zohocorp | manageengine_m365_manager_plus |
Affected:
0 , < 4817
(custom)
|
|
| zohocorp | manageengine_adaudit_plus |
Affected:
0 , < 8703
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11374",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-24T03:56:06.337907Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T15:48:27.756Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "manageengine_adselfservice_plus",
"vendor": "zohocorp",
"versions": [
{
"lessThan": "6529",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "manageengine_recovery_manager_plus",
"vendor": "zohocorp",
"versions": [
{
"lessThan": "6321",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "manageengine_m365_manager_plus",
"vendor": "zohocorp",
"versions": [
{
"lessThan": "4817",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "manageengine_adaudit_plus",
"vendor": "zohocorp",
"versions": [
{
"lessThan": "8703",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted\n by an unauthenticated user, leading to account takeover."
}
],
"value": "In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted\n by an unauthenticated user, leading to account takeover."
}
],
"impacts": [
{
"capecId": "CAPEC-59",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-59 Session Credential Falsification through Prediction"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-340",
"description": "CWE-340: Generation of Predictable Numbers or Identifiers",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330: Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T08:19:30.638Z",
"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
"shortName": "Zohocorp"
},
"references": [
{
"url": "https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Account Takeover via Predictable SSO Ticket Generation",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
"assignerShortName": "Zohocorp",
"cveId": "CVE-2026-11374",
"datePublished": "2026-06-23T08:19:30.638Z",
"dateReserved": "2026-06-05T12:25:17.739Z",
"dateUpdated": "2026-06-24T15:48:27.756Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7847 (GCVE-0-2026-7847)
Vulnerability from cvelistv5 – Published: 2026-05-05 16:30 – Updated: 2026-05-06 15:25
VLAI
EPSS
VEX
Title
chatchat-space Langchain-Chatchat Uploaded File openai_routes.py _get_file_id random values
Summary
A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Uploaded File Handler. Performing a manipulation results in insufficiently random values. Access to the local network is required for this attack. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/361126 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/361126/cti | signaturepermissions-required |
| https://vuldb.com/submit/807796 | third-party-advisory |
| https://github.com/chatchat-space/Langchain-Chatc… | issue-tracking |
| https://github.com/3em0/cve_repo/blob/main/Langch… | exploit |
| https://github.com/chatchat-space/Langchain-Chatchat/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| chatchat-space | Langchain-Chatchat |
Affected:
0.3.1.0
Affected: 0.3.1.1 Affected: 0.3.1.2 Affected: 0.3.1.3 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7847",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-05T18:41:10.851490Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-06T15:25:12.075Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Uploaded File Handler"
],
"product": "Langchain-Chatchat",
"vendor": "chatchat-space",
"versions": [
{
"status": "affected",
"version": "0.3.1.0"
},
{
"status": "affected",
"version": "0.3.1.1"
},
{
"status": "affected",
"version": "0.3.1.2"
},
{
"status": "affected",
"version": "0.3.1.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem00 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Uploaded File Handler. Performing a manipulation results in insufficiently random values. Access to the local network is required for this attack. The attack\u0027s complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.6,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.6,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.4,
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-310",
"description": "Cryptographic Issues",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-05T16:30:13.695Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-361126 | chatchat-space Langchain-Chatchat Uploaded File openai_routes.py _get_file_id random values",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/361126"
},
{
"name": "VDB-361126 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/361126/cti"
},
{
"name": "Submit #807796 | chatchat-space Langchain-Chatchat 0.3.1.3 Use of Insufficiently Random Values / CWE-330",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/807796"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/chatchat-space/Langchain-Chatchat/issues/5464"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/3em0/cve_repo/blob/main/Langchain-Chatchat/Vuln-3-Predictable-File-ID.md"
},
{
"tags": [
"product"
],
"url": "https://github.com/chatchat-space/Langchain-Chatchat/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-05T12:26:20.000Z",
"value": "VulDB entry last update"
}
],
"title": "chatchat-space Langchain-Chatchat Uploaded File openai_routes.py _get_file_id random values"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-7847",
"datePublished": "2026-05-05T16:30:13.695Z",
"dateReserved": "2026-05-05T10:21:00.280Z",
"dateUpdated": "2026-05-06T15:25:12.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2966 (GCVE-0-2026-2966)
Vulnerability from cvelistv5 – Published: 2026-02-23 02:02 – Updated: 2026-02-23 13:36 X_Open Source
VLAI
EPSS
VEX
Title
Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values
Summary
A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. Executing a manipulation of the argument random can lead to insufficiently random values. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.347333 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.347333 | signaturepermissions-required |
| https://vuldb.com/?submit.755304 | third-party-advisory |
| https://github.com/dwBruijn/CVEs/blob/main/Mongoo… | related |
| https://github.com/dwBruijn/CVEs/blob/main/Mongoo… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cesanta | Mongoose |
Affected:
7.0
Affected: 7.1 Affected: 7.2 Affected: 7.3 Affected: 7.4 Affected: 7.5 Affected: 7.6 Affected: 7.7 Affected: 7.8 Affected: 7.9 Affected: 7.10 Affected: 7.11 Affected: 7.12 Affected: 7.13 Affected: 7.14 Affected: 7.15 Affected: 7.16 Affected: 7.17 Affected: 7.18 Affected: 7.19 Affected: 7.20 cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2966",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-23T13:36:36.825692Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T13:36:51.905Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*"
],
"modules": [
"DNS Transaction ID Handler"
],
"product": "Mongoose",
"vendor": "Cesanta",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"status": "affected",
"version": "7.1"
},
{
"status": "affected",
"version": "7.2"
},
{
"status": "affected",
"version": "7.3"
},
{
"status": "affected",
"version": "7.4"
},
{
"status": "affected",
"version": "7.5"
},
{
"status": "affected",
"version": "7.6"
},
{
"status": "affected",
"version": "7.7"
},
{
"status": "affected",
"version": "7.8"
},
{
"status": "affected",
"version": "7.9"
},
{
"status": "affected",
"version": "7.10"
},
{
"status": "affected",
"version": "7.11"
},
{
"status": "affected",
"version": "7.12"
},
{
"status": "affected",
"version": "7.13"
},
{
"status": "affected",
"version": "7.14"
},
{
"status": "affected",
"version": "7.15"
},
{
"status": "affected",
"version": "7.16"
},
{
"status": "affected",
"version": "7.17"
},
{
"status": "affected",
"version": "7.18"
},
{
"status": "affected",
"version": "7.19"
},
{
"status": "affected",
"version": "7.20"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dwbruijn (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. Executing a manipulation of the argument random can lead to insufficiently random values. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-310",
"description": "Cryptographic Issues",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T02:02:08.202Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-347333 | Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.347333"
},
{
"name": "VDB-347333 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.347333"
},
{
"name": "Submit #755304 | Cesanta Mongoose Embedded Web Server 7.20 Insufficiently Random Values",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.755304"
},
{
"tags": [
"related"
],
"url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/mg_sendnsreq.md"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/mg_sendnsreq.md#poc"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-02-22T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-02-22T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-02-22T09:02:36.000Z",
"value": "VulDB entry last update"
}
],
"title": "Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-2966",
"datePublished": "2026-02-23T02:02:08.202Z",
"dateReserved": "2026-02-22T07:57:24.272Z",
"dateUpdated": "2026-02-23T13:36:51.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68704 (GCVE-0-2025-68704)
Vulnerability from cvelistv5 – Published: 2026-01-13 19:29 – Updated: 2026-01-13 19:54
VLAI
EPSS
VEX
Title
Jervis has a Weak Random for Timing Attack Mitigation
Summary
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/samrocketman/jervis/security/a… | x_refsource_CONFIRM |
| https://github.com/samrocketman/jervis/commit/c39… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| samrocketman | jervis |
Affected:
< 2.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68704",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-13T19:54:07.357853Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T19:54:12.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "jervis",
"vendor": "samrocketman",
"versions": [
{
"status": "affected",
"version": "\u003c 2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330: Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T19:29:06.771Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww"
},
{
"name": "https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a"
}
],
"source": {
"advisory": "GHSA-c9q6-g3hr-8gww",
"discovery": "UNKNOWN"
},
"title": "Jervis has a Weak Random for Timing Attack Mitigation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-68704",
"datePublished": "2026-01-13T19:29:06.771Z",
"dateReserved": "2025-12-23T22:32:51.733Z",
"dateUpdated": "2026-01-13T19:54:12.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-66511 (GCVE-0-2025-66511)
Vulnerability from cvelistv5 – Published: 2025-12-05 16:42 – Updated: 2025-12-05 16:53
VLAI
EPSS
VEX
Title
Nextcloud Calendar app used predictable proposal participant tokens
Summary
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nextcloud/security-advisories/… | x_refsource_CONFIRM |
| https://github.com/nextcloud/calendar/pull/7659 | x_refsource_MISC |
| https://github.com/nextcloud/calendar/commit/8de1… | x_refsource_MISC |
| https://hackerone.com/reports/3385434 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nextcloud | security-advisories |
Affected:
>= 6.0.0-rc.1, < 6.0.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-66511",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-05T16:53:43.707700Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-05T16:53:52.674Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "security-advisories",
"vendor": "nextcloud",
"versions": [
{
"status": "affected",
"version": "\u003e= 6.0.0-rc.1, \u003c 6.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330: Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-05T16:42:30.236Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-whm3-vv55-gf27",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-whm3-vv55-gf27"
},
{
"name": "https://github.com/nextcloud/calendar/pull/7659",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextcloud/calendar/pull/7659"
},
{
"name": "https://github.com/nextcloud/calendar/commit/8de14ae87f321f5f09280d9895a27d54d24f33fb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextcloud/calendar/commit/8de14ae87f321f5f09280d9895a27d54d24f33fb"
},
{
"name": "https://hackerone.com/reports/3385434",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/3385434"
}
],
"source": {
"advisory": "GHSA-whm3-vv55-gf27",
"discovery": "UNKNOWN"
},
"title": "Nextcloud Calendar app used predictable proposal participant tokens"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-66511",
"datePublished": "2025-12-05T16:42:30.236Z",
"dateReserved": "2025-12-03T15:28:02.991Z",
"dateUpdated": "2025-12-05T16:53:52.674Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds.
- In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts.
- Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.
Mitigation
Implementation
Consider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
Mitigation MIT-2
Architecture and Design
Requirements
Strategy: Libraries or Frameworks
Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
CAPEC-112: Brute Force
In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.
CAPEC-485: Signature Spoofing by Key Recreation
An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.