The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
131 vulnerabilities with CWE-331
CVE-2026-46473
HIGH
Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand
CVSS 7.5
CVE-2026-8700
HIGH
Crypt::DSA versions before 1.20 for Perl generate seeds using rand
CVSS 7.3
CVE-2026-46474
HIGH
Trog::TOTP versions before 1.006 for Perl generate secrets using rand
CVSS 7.5
CVE-2026-42155
CRITICAL
Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs
CVE-2026-4827
HIGH
Schneider Electric Easergy MiCOM C264 - Insufficient Entropy Vulnerability on Multiple Products
CVE-2026-7210
HIGH
The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
CVSS 7.5
CVE-2026-2336
HIGH
Weak webstax_auth Cookie Authentication Allows Privilege Escalation
CVE-2026-41080
LOW
libexpat < 2.8.0 - Hash Flooding via Insufficient Entropy
CVSS 2.9
CVE-2026-34236
HIGH
Auth0 PHP SDK Insufficient Entropy in Cookie Encryption
CVSS 8.2
CVE-2026-2878
MEDIUM
Progress Telerik UI for AJAX <2026.1.225 - Info Disclosure
CVSS 5.3
CVE-2026-2541
MEDIUM
Micca Car Alarm System KE700 - Insufficient Entropy in Rolling Code Authentication
CVE-2026-1814
MEDIUM
Rapid7 Nexpose >=6.4.50 - Info Disclosure
CVE-2026-22698
HIGH
RustCrypto sm2 < 0.14.0-rc.0 - Low-Entropy Nonce Ciphertext Decryption
CVSS 7.5
CVE-2025-14972
MEDIUM
Simplicity SDK - Insufficient Entropy in SYMCRYPTO DPA Countermeasures
CVE-2025-0577
MEDIUM
Red Hat Enterprise Linux - Insufficient Entropy in glibc Randomness Functions
CVSS 4.8
CVE-2025-7432
LOW
Silicon Labs' Series 2 - Info Disclosure
CVE-2025-13399
HIGH
TP-Link VX800v Firmware < 800.0.11 - Unauthenticated Weak AES Key Brute Force in Web Interface
CVSS 8.8
CVE-2025-15387
HIGH
QNO Technology VPN Firewall - Unauthenticated Session Hijacking via Insufficient Entropy
CVSS 8.8
CVE-2025-67504
CRITICAL
WBCE CMS < 1.6.5 - Weak Password Generation via Insecure rand() Usage
CVSS 9.1
CVE-2025-66565
CRITICAL
Fiber Utils <2.0.0-rc.3 - Info Disclosure
CVSS 9.8
CVE-2025-14261
HIGH
Litmus < 3.23.0 - Insufficient JWT Secret Entropy
CVSS 7.1
CVE-2025-32898
MEDIUM
KDE Connect <2025-04-18 - Info Disclosure
CVSS 4.7
CVE-2025-62774
LOW
Mercku M6a <2.1.0 - Info Disclosure
CVSS 3.1
CVE-2025-59015
MEDIUM
TYPO3 CMS <13.4.17 - Info Disclosure
CVSS 6.5
CVE-2025-54885
MEDIUM
Thinbus Javascript Secure Remote Password <2.0.0 - Info Disclosure
Details
Vulnerabilities
131