Total
146 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-52464 | 1 Meshtastic | 1 Meshtastic Firmware | 2026-06-17 | N/A | 8.3 HIGH |
| Meshtastic is an open source mesh networking solution. In versions from 2.5.0 to before 2.6.11, the flashing procedure of several hardware vendors was resulting in duplicated public/private keys. Additionally, the Meshtastic was failing to properly initialize the internal randomness pool on some platforms, leading to possible low-entropy key generation. When users with an affected key pair sent Direct Messages, those message could be captured and decrypted by an attacker that has compiled the list of compromised keys. This issue has been patched in version 2.6.11 where key generation is delayed til the first time the LoRa region is set, along with warning users when a compromised key is detected. Version 2.6.12 furthers this patch by automatically wiping known compromised keys when found. A workaround to this vulnerability involves users doing a complete device wipe to remove vendor-cloned keys. | |||||
| CVE-2025-50122 | 2026-06-17 | N/A | N/A | ||
| A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with access to installation or upgrade artifacts. | |||||
| CVE-2025-47781 | 1 Rallly | 1 Rallly | 2026-06-17 | N/A | 9.8 CRITICAL |
| Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based authentication. When a user attempts to login to the application, they insert their email and a 6 digit code is sent to their email address to complete the authentication. A token that consists of 6 digits only presents weak entropy however and when coupled with no token brute force protection, makes it possible for an unauthenticated attacker with knowledge of a valid email address to successfully brute force the token within 15 minutes (token expiration time) and take over the account associated with the targeted email address. All users on the Rallly applications are impacted. As long as an attacker knows the user's email address they used to register on the app, they can systematically take over any user account. For the authentication mechanism to be safe, the token would need to be assigned a complex high entropy value that cannot be bruteforced within reasonable time, and ideally rate limiting the /api/auth/callback/email endpoint to further make brute force attempts unreasonable within the 15 minutes time. As of time of publication, no patched versions are available. | |||||
| CVE-2025-32898 | 2026-06-17 | N/A | 4.7 MEDIUM | ||
| The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59. | |||||
| CVE-2025-2814 | 2026-06-17 | N/A | 4.0 MEDIUM | ||
| Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to use the insecure rand() function. | |||||
| CVE-2025-29311 | 1 Opennetworking | 1 Onos | 2026-06-17 | N/A | 7.5 HIGH |
| Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack. Attackers are able to leverage this vulnerability into creating crafted LLDP packets. | |||||
| CVE-2025-27552 | 2026-06-17 | N/A | 4.0 MEDIUM | ||
| DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with program files Crypt/Eksblowfish/Bcrypt.pm. This issue affects DBIx::Class::EncodedColumn until 0.00032. | |||||
| CVE-2025-27551 | 2026-06-17 | N/A | 4.0 MEDIUM | ||
| DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with program files lib/DBIx/Class/EncodedColumn/Digest.pm. This issue affects DBIx::Class::EncodedColumn until 0.00032. | |||||
| CVE-2025-1860 | 2026-06-17 | N/A | 7.7 HIGH | ||
| Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. | |||||
| CVE-2025-1828 | 1 Timlegge | 1 Crypt\ | 2026-06-17 | N/A | 8.8 HIGH |
| Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider. In particular, Windows versions of perl will encounter this issue by default. | |||||
| CVE-2025-15387 | 2026-06-17 | N/A | 8.8 HIGH | ||
| VPN Firewall developed by QNO Technology has a Insufficient Entropy vulnerability, allowing unauthenticated remote attackers to obtain any logged-in user session through brute-force attacks and subsequently log into the system. | |||||
| CVE-2025-14972 | 2026-06-17 | N/A | N/A | ||
| * Countermeasures for DPA within SYMCRYPTO engine on SixG301xxx devices are not sufficiently random and will eventually repeat. * KSU keys using SYMCRYPTO will be impacted by this vulnerability. | |||||
| CVE-2025-14261 | 2026-06-17 | N/A | 7.1 HIGH | ||
| The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes it extremely easy to crack. | |||||
| CVE-2025-13399 | 1 Tp-link | 2 Vx800v, Vx800v Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercepted traffic. Successful exploitation requires network proximity but no authentication, and may result in high impact to confidentiality, integrity, and availability of transmitted data. | |||||
| CVE-2025-0577 | 2026-06-17 | N/A | 4.8 MEDIUM | ||
| An insufficient entropy vulnerability was found in glibc. The getrandom and arc4random family of functions may return predictable randomness if these functions are called again after the fork, which happens concurrently with a call to any of these functions. | |||||
| CVE-2024-9055 | 2026-06-17 | N/A | 4.2 MEDIUM | ||
| The DPA countermeasures on Silicon Labs' Series 2 devices are not reseeded periodically as they should be. This may allow an attacker to eventually extract secret keys through a DPA attack. | |||||
| CVE-2024-8796 | 1 Tinfoilsecurity | 1 Devise-two-factor | 2026-06-17 | N/A | 5.3 MEDIUM |
| Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-factor authentication code could make it easier for an attacker to guess the shared secret and generate valid TOTP codes. | |||||
| CVE-2024-58134 | 1 Mojolicious | 1 Mojolicious | 2026-06-17 | N/A | 8.1 HIGH |
| Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session. | |||||
| CVE-2024-58040 | 1 Qwer | 1 Crypt\ | 2026-06-17 | N/A | 9.1 CRITICAL |
| Crypt::RandomEncryption for Perl version 0.01 uses insecure rand() function during encryption. | |||||
| CVE-2024-58036 | 1 Norbu09 | 1 Net\ | 2026-06-17 | N/A | 5.5 MEDIUM |
| Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Net::Dropbox::API uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function. | |||||