Monthly
Account takeover in Omnispace Agora Project before 26.10.0 is enabled by predictable default and temporary account passwords: Txt::defaultPassword() derives those passwords from PHP's uniqid(), which is seeded on microsecond server time rather than a cryptographically secure random source. An attacker who can observe or closely approximate the moment an account was created can reconstruct the uniqid() value, compute the generated password, and authenticate as that user before the legitimate owner first logs in and changes it. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N) describes a network-reachable, unauthenticated attack that severely compromises confidentiality and integrity but carries high attack complexity because the timing reconstruction and the pre-first-login race must both succeed; no public exploit code identified at time of analysis, and the input contains no CISA KEV listing, so active exploitation is not confirmed.
Predictable pre-shared key generation in the TP-Link Tapo C325WB V2 camera's local media streaming service allows an unauthenticated attacker on the adjacent network to recover the key and authenticate to the stream without credentials. This enables access and takeover of live video and audio feeds, compromising confidentiality and integrity. The vulnerability is rated 8.7 (High) with no public exploit identified at time of analysis; a vendor firmware patch is available.
Predictable, insufficiently random values in Dell Container Storage Modules (CSM) before 1.18.0 allow an unauthenticated attacker with local access to a host or Kubernetes node to tamper with information and degrade availability (CVSS 7.7, C:N/I:H/A:H). The flaw cannot be triggered over the network - it requires local presence on a CSM-managed node - and needs no user interaction, while confidentiality is unaffected. No public exploit code has been identified at time of analysis, and the local-access prerequisite keeps this a moderate-priority issue rather than a high-urgency one despite its High base score.
Unauthenticated remote attackers can read other customers' order records - including billing addresses, customer details, and purchased downloadable files - on Isotope eCommerce installations through 2.9.10 that accept guest orders, because order identifiers are generated from PHP's time-seeded uniqid() function and the guest order-details module performs no ownership verification. Exploitation requires guessing a valid uid value, which is why the flaw carries high attack complexity rather than being trivially scriptable, but no authentication or user interaction is needed. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the practical exposure is a bounded but genuine confidentiality risk confined to shops exposing guest checkout.
Predictable session-token generation in the web management portal of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 console servers allows unauthenticated attackers to derive a valid token belonging to a logged-in user and replay it from a different source address, achieving elevated privileges on the device and potentially on downstream serial-attached equipment. Session tokens are produced deterministically from the device model plus the current time at one-second resolution, leaving only a small enumerable keyspace, and a crafted URI that abuses file-extension handling in the web server's path routing defeats the per-session source-IP and User-Agent validation. Rated CVSS 4.0 base 8.9 (AV:N/AC:L/AT:P/PR:N/UI:A, all impacts High) with our independent assessment at CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; exploitation requires network reachability to the portal and a legitimate user session to be live, no public exploit has been identified at time of analysis, and all firmware versions are affected so version-based mitigation is unavailable from the provided data.
Unauthenticated remote attackers can achieve account takeover in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 by guessing weakly generated activation/login pairing codes. The getRandomCode() function in objects/functions.php relies on uniqid() output, limiting the code space to roughly 2^25 values for a known generation second; the plugin/API/set.json.php?APIName=login_code endpoint leaks server microtime as an oracle, and a guessed valid code (10-minute TTL) redeemed at plugin/API/get.json.php?APIName=login_code yields the victim's email and a one-year User::getUserHash credential. No vendor patch is available and no public exploit code has been identified, though the weak PRNG and unauthenticated oracle make the attack a genuine account-takeover primitive tempered by high attack complexity (AC:H/AT:P) due to the timed probabilistic guess.
Stream-key forgery in WWBN AVideo lets remote unauthenticated attackers reconstruct a live channel's RTMP publish key and broadcast content as the channel owner, by brute-forcing the roughly one million microsecond candidates produced by PHP's uniqid() in the LiveTransmition component. Exploitation requires the live-streaming feature to be in use and the attacker to know or closely estimate the target channel's creation timestamp, which is why exploitability is assessed as high complexity/high attack requirements despite the unauthenticated network vector. Only integrity of the published stream is at stake (no account takeover, code execution, or data disclosure), and no public exploit identified at time of analysis; the raw vendor CVSS 4.0 score of 8.3 overstates the practical ease of exploitation relative to the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Let me parse the data. CVE-2026-19407: Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1. Allows RCE and tenant-project token theft. CVSS 7.7, CVSS 4.0 vector: AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L. CWE-330 (Use of Insufficiently Random Entropy — actually CWE-330 is "Use of Insufficiently Random Values"). Bucket squatting: attacker registers a cloud storage bucket name that the SDK attempts to use (predictable/guessable name), and the SDK downloads code/artifacts from that bucket, leading to RCE. Related to insufficient randomness in bucket naming. EPSS: not provided. KEV: not provided (no). POC: not provided. Note discrepancy: Description says versions prior to 1.166.1; EUVD says "1.16.0 <1.165.1". That's a data conflict — flag in confidence_notes. Patch: Available from vendor — release notes from March 31, 2026. Affected products: Google Cloud Gemini Enterprise Agent Platform SDK for Python, versions prior to 1.166.1 (fix version 1.166.1). Prevalence: This is a specific SDK — medium/low. It's a Google Cloud SDK for an agent platform — niche enterprise. I'd say "low". Hmm. Gemini Enterprise Agent Platform SDK for Python — AI agent dev kit. Deployment footprint probably low-medium. I'll say "low" with basis "specialized Google Cloud AI agent SDK, limited deployment footprint". Actually maybe "medium" since Google Cloud + Gemini is popular. But the specific SDK for agent platform — low. I'll go with "low". Assessed CVSS vector: AT:P means attack requirements are present (attacker must pre-register the bucket name — that's an attack requirement). PR:N, UI:P (victim must run the SDK / user interaction). So my 3.1 vector: AV:N/AC:H/PR:N/UI:R/S:C? Hmm. Scope — subsequent system impact SC:L/SI:L/SA:L, so scope changed in 3.1 terms. Let's do: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. Hmm, but scope change with C:H/I:H/A:H might be too high. Actually the vulnerable system impact is H/H/H.
JWT token forgery in yfexam-exam v2.0 exposes any authenticated session to impersonation because the signing secret is derived entirely from the username and the current calendar month - two low-entropy, often-public values - rather than a server-side cryptographic secret. An attacker who knows or can enumerate a target's username can deterministically compute the signing secret (only 12 possible month values) and mint forged tokens claiming arbitrary privileges without ever knowing the target's password. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), but a public GitHub writeup by fangtang7 documents the technique, materially lowering the bar for any attacker who targets this application.
External-login account password generation in WWBN AVideo uses PHP's non-cryptographic rand() function, producing a keyspace of only 2^31 integers, and stores resulting passwords as unsalted MD5 hashes. An attacker who obtains the AVideo password hash database can exhaustively search the entire 2-billion-entry keyspace in seconds to minutes on commodity GPU hardware, recovering plaintext credentials for all external-login accounts. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 7.4 reflects the prerequisite of prior hash access.
Account takeover in Omnispace Agora Project before 26.10.0 is enabled by predictable default and temporary account passwords: Txt::defaultPassword() derives those passwords from PHP's uniqid(), which is seeded on microsecond server time rather than a cryptographically secure random source. An attacker who can observe or closely approximate the moment an account was created can reconstruct the uniqid() value, compute the generated password, and authenticate as that user before the legitimate owner first logs in and changes it. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N) describes a network-reachable, unauthenticated attack that severely compromises confidentiality and integrity but carries high attack complexity because the timing reconstruction and the pre-first-login race must both succeed; no public exploit code identified at time of analysis, and the input contains no CISA KEV listing, so active exploitation is not confirmed.
Predictable pre-shared key generation in the TP-Link Tapo C325WB V2 camera's local media streaming service allows an unauthenticated attacker on the adjacent network to recover the key and authenticate to the stream without credentials. This enables access and takeover of live video and audio feeds, compromising confidentiality and integrity. The vulnerability is rated 8.7 (High) with no public exploit identified at time of analysis; a vendor firmware patch is available.
Predictable, insufficiently random values in Dell Container Storage Modules (CSM) before 1.18.0 allow an unauthenticated attacker with local access to a host or Kubernetes node to tamper with information and degrade availability (CVSS 7.7, C:N/I:H/A:H). The flaw cannot be triggered over the network - it requires local presence on a CSM-managed node - and needs no user interaction, while confidentiality is unaffected. No public exploit code has been identified at time of analysis, and the local-access prerequisite keeps this a moderate-priority issue rather than a high-urgency one despite its High base score.
Unauthenticated remote attackers can read other customers' order records - including billing addresses, customer details, and purchased downloadable files - on Isotope eCommerce installations through 2.9.10 that accept guest orders, because order identifiers are generated from PHP's time-seeded uniqid() function and the guest order-details module performs no ownership verification. Exploitation requires guessing a valid uid value, which is why the flaw carries high attack complexity rather than being trivially scriptable, but no authentication or user interaction is needed. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the practical exposure is a bounded but genuine confidentiality risk confined to shops exposing guest checkout.
Predictable session-token generation in the web management portal of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 console servers allows unauthenticated attackers to derive a valid token belonging to a logged-in user and replay it from a different source address, achieving elevated privileges on the device and potentially on downstream serial-attached equipment. Session tokens are produced deterministically from the device model plus the current time at one-second resolution, leaving only a small enumerable keyspace, and a crafted URI that abuses file-extension handling in the web server's path routing defeats the per-session source-IP and User-Agent validation. Rated CVSS 4.0 base 8.9 (AV:N/AC:L/AT:P/PR:N/UI:A, all impacts High) with our independent assessment at CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; exploitation requires network reachability to the portal and a legitimate user session to be live, no public exploit has been identified at time of analysis, and all firmware versions are affected so version-based mitigation is unavailable from the provided data.
Unauthenticated remote attackers can achieve account takeover in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 by guessing weakly generated activation/login pairing codes. The getRandomCode() function in objects/functions.php relies on uniqid() output, limiting the code space to roughly 2^25 values for a known generation second; the plugin/API/set.json.php?APIName=login_code endpoint leaks server microtime as an oracle, and a guessed valid code (10-minute TTL) redeemed at plugin/API/get.json.php?APIName=login_code yields the victim's email and a one-year User::getUserHash credential. No vendor patch is available and no public exploit code has been identified, though the weak PRNG and unauthenticated oracle make the attack a genuine account-takeover primitive tempered by high attack complexity (AC:H/AT:P) due to the timed probabilistic guess.
Stream-key forgery in WWBN AVideo lets remote unauthenticated attackers reconstruct a live channel's RTMP publish key and broadcast content as the channel owner, by brute-forcing the roughly one million microsecond candidates produced by PHP's uniqid() in the LiveTransmition component. Exploitation requires the live-streaming feature to be in use and the attacker to know or closely estimate the target channel's creation timestamp, which is why exploitability is assessed as high complexity/high attack requirements despite the unauthenticated network vector. Only integrity of the published stream is at stake (no account takeover, code execution, or data disclosure), and no public exploit identified at time of analysis; the raw vendor CVSS 4.0 score of 8.3 overstates the practical ease of exploitation relative to the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Let me parse the data. CVE-2026-19407: Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1. Allows RCE and tenant-project token theft. CVSS 7.7, CVSS 4.0 vector: AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L. CWE-330 (Use of Insufficiently Random Entropy — actually CWE-330 is "Use of Insufficiently Random Values"). Bucket squatting: attacker registers a cloud storage bucket name that the SDK attempts to use (predictable/guessable name), and the SDK downloads code/artifacts from that bucket, leading to RCE. Related to insufficient randomness in bucket naming. EPSS: not provided. KEV: not provided (no). POC: not provided. Note discrepancy: Description says versions prior to 1.166.1; EUVD says "1.16.0 <1.165.1". That's a data conflict — flag in confidence_notes. Patch: Available from vendor — release notes from March 31, 2026. Affected products: Google Cloud Gemini Enterprise Agent Platform SDK for Python, versions prior to 1.166.1 (fix version 1.166.1). Prevalence: This is a specific SDK — medium/low. It's a Google Cloud SDK for an agent platform — niche enterprise. I'd say "low". Hmm. Gemini Enterprise Agent Platform SDK for Python — AI agent dev kit. Deployment footprint probably low-medium. I'll say "low" with basis "specialized Google Cloud AI agent SDK, limited deployment footprint". Actually maybe "medium" since Google Cloud + Gemini is popular. But the specific SDK for agent platform — low. I'll go with "low". Assessed CVSS vector: AT:P means attack requirements are present (attacker must pre-register the bucket name — that's an attack requirement). PR:N, UI:P (victim must run the SDK / user interaction). So my 3.1 vector: AV:N/AC:H/PR:N/UI:R/S:C? Hmm. Scope — subsequent system impact SC:L/SI:L/SA:L, so scope changed in 3.1 terms. Let's do: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. Hmm, but scope change with C:H/I:H/A:H might be too high. Actually the vulnerable system impact is H/H/H.
JWT token forgery in yfexam-exam v2.0 exposes any authenticated session to impersonation because the signing secret is derived entirely from the username and the current calendar month - two low-entropy, often-public values - rather than a server-side cryptographic secret. An attacker who knows or can enumerate a target's username can deterministically compute the signing secret (only 12 possible month values) and mint forged tokens claiming arbitrary privileges without ever knowing the target's password. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), but a public GitHub writeup by fangtang7 documents the technique, materially lowering the bar for any attacker who targets this application.
External-login account password generation in WWBN AVideo uses PHP's non-cryptographic rand() function, producing a keyspace of only 2^31 integers, and stores resulting passwords as unsalted MD5 hashes. An attacker who obtains the AVideo password hash database can exhaustively search the entire 2-billion-entry keyspace in seconds to minutes on commodity GPU hardware, recovering plaintext credentials for all external-login accounts. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 7.4 reflects the prerequisite of prior hash access.