Monthly
Local privilege escalation in NoMachine allows an attacker who already has low-privileged code execution on the host to abuse predictably generated Redis database credentials and execute arbitrary code in the context of the service account. The flaw is CWE-331 insufficient entropy in the authentication mechanism for NoMachine's bundled Redis database, rated CVSS 7.8 with a local vector requiring low privileges but no user interaction. The supplied intelligence did not include a CISA KEV entry or public exploit code, so no public exploit was identified at time of analysis; risk is bounded because an initial local foothold is mandatory and no remote network vector exists.
Synology DiskStation Manager (DSM) login logic uses insufficiently random values, letting remote unauthenticated attackers (CVSS PR:N) read or write arbitrary files and mount denial-of-service attacks on NAS devices running DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Synology rates the flaw 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), while independent assessment keeps the same impact but raises attack complexity to High, since the attacker must successfully predict or reproduce the weakly-random login value, potentially requiring repeated attempts or offline computation. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the unaudited attack surface (DSM's web login on typical management ports) and full CIA impact make prompt patching the priority for any internet-reachable instance.
Administrator account takeover in LangBot before 4.10.11 stems from password-recovery keys generated with only 24 bits of entropy (secrets.token_hex(3)) combined with a total absence of rate limiting on the unauthenticated reset-password endpoint. A remote attacker who knows the administrator's email address can fire concurrent requests to exhaust the ~16.7M-value keyspace and reset the admin password, seizing full control of the instance. VulnCheck reported the issue and a vendor patch exists (4.10.11); no public exploit is identified at time of analysis, and the flaw is not in CISA KEV.
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session identifiers generated with insufficient randomness, producing low-entropy tokens that a remote attacker can predict or brute-force. By deriving a valid session identifier, an unauthenticated attacker can impersonate a legitimate session and gain access to protected relay functions. No public exploit identified at time of analysis; the issue is fixed in V2.70 per Siemens advisory SSA-142885.
Unauthenticated access to inline images in Combodo iTop prior to version 3.2.3 is protected by a 24-bit secret generated with PHP's non-cryptographic mt_rand(), yielding only ~16.7 million possible values and making brute-force enumeration feasible for any network-reachable attacker. The commit diff confirms the secret was stored as a 6-character hex string (sprintf('%06x', mt_rand(0, 0xFFFFFF))), and a secondary timing side-channel existed because the comparison used != instead of constant-time hash_equals(). No active exploitation is confirmed in CISA KEV, and no public POC has been identified at time of analysis.
Insufficient-entropy secret generation in the crypto-js npm library (all 3.x releases except 3.2.0/3.2.1, i.e. versions < 4.0.0) collapses CryptoJS.lib.WordArray.random() to effective search spaces of only ~2^39 (128-bit request) and ~2^47 (256-bit request), letting attackers brute-force any long-term secret produced by it. Downstream cryptocurrency wallets used this function as the entropy source for BIP39 recovery phrases; Coinspect's 'Ill Bloom' investigation reproduced full key recovery and documented coordinated drain waves that stole a lower-bound of ~$5M in assets as of 13 July 2026. This is not in CISA KEV, but a proof of concept exists and real-world theft has been documented by the researchers.
Predictable API key generation in osTicket 1.18.3 lets remote attackers reconstruct valid staff API keys by exploiting weak MD5-based construction seeded with the request timestamp and client IP address (CWE-331). Because the key is derived from low-entropy, guessable inputs, an attacker who approximates the key creation window can brute-force the key space and gain API access without credentials. Rated CVSS 9.8 by the reporter; no public exploit is identified at time of analysis, though a technical disclosure write-up exists, and CISA SSVC lists exploitation as none but marks the flaw automatable with total technical impact.
Improper API key generation in Sonatype Nexus Repository Manager lets a remote attacker impersonate a targeted user and perform repository operations on their behalf. The flaw stems from insufficient entropy (CWE-331) in format-specific API key realms, so an attacker who can predict or reconstruct a victim's key gains their access without credentials. The vendor (Sonatype) reported and patched the issue in release 3.93.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reduced cryptographic key protection in Silicon Labs' SiXG301 SYMCRYPTO hardware engine (exposed via the Simplicity SDK PSA crypto library) allows an attacker who already has on-device code execution to weaken the engine's Differential Power Analysis (DPA) countermeasures by forcing low-entropy seed values, making AES/hashing keys far easier to recover through subsequent power-analysis side-channel attacks. The flaw affects embedded systems built on the SiXG301 SoC and was reported by Silicon Labs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation also requires physical access to the device for the power measurements.
Weak secret generation in the Authen::TOTP Perl module before version 0.1.1 lets attackers predict TOTP shared secrets because they were built with Perl's non-cryptographic rand() function. Any application relying on this module to seed two-factor authentication produces guessable secrets, undermining the OTP protection it was meant to provide. There is no public exploit identified at time of analysis, and EPSS rates near-zero (0.01%) exploitation probability, but the fix (0.1.1) is confirmed in the vendor changelog.
Local privilege escalation in NoMachine allows an attacker who already has low-privileged code execution on the host to abuse predictably generated Redis database credentials and execute arbitrary code in the context of the service account. The flaw is CWE-331 insufficient entropy in the authentication mechanism for NoMachine's bundled Redis database, rated CVSS 7.8 with a local vector requiring low privileges but no user interaction. The supplied intelligence did not include a CISA KEV entry or public exploit code, so no public exploit was identified at time of analysis; risk is bounded because an initial local foothold is mandatory and no remote network vector exists.
Synology DiskStation Manager (DSM) login logic uses insufficiently random values, letting remote unauthenticated attackers (CVSS PR:N) read or write arbitrary files and mount denial-of-service attacks on NAS devices running DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Synology rates the flaw 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), while independent assessment keeps the same impact but raises attack complexity to High, since the attacker must successfully predict or reproduce the weakly-random login value, potentially requiring repeated attempts or offline computation. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the unaudited attack surface (DSM's web login on typical management ports) and full CIA impact make prompt patching the priority for any internet-reachable instance.
Administrator account takeover in LangBot before 4.10.11 stems from password-recovery keys generated with only 24 bits of entropy (secrets.token_hex(3)) combined with a total absence of rate limiting on the unauthenticated reset-password endpoint. A remote attacker who knows the administrator's email address can fire concurrent requests to exhaust the ~16.7M-value keyspace and reset the admin password, seizing full control of the instance. VulnCheck reported the issue and a vendor patch exists (4.10.11); no public exploit is identified at time of analysis, and the flaw is not in CISA KEV.
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session identifiers generated with insufficient randomness, producing low-entropy tokens that a remote attacker can predict or brute-force. By deriving a valid session identifier, an unauthenticated attacker can impersonate a legitimate session and gain access to protected relay functions. No public exploit identified at time of analysis; the issue is fixed in V2.70 per Siemens advisory SSA-142885.
Unauthenticated access to inline images in Combodo iTop prior to version 3.2.3 is protected by a 24-bit secret generated with PHP's non-cryptographic mt_rand(), yielding only ~16.7 million possible values and making brute-force enumeration feasible for any network-reachable attacker. The commit diff confirms the secret was stored as a 6-character hex string (sprintf('%06x', mt_rand(0, 0xFFFFFF))), and a secondary timing side-channel existed because the comparison used != instead of constant-time hash_equals(). No active exploitation is confirmed in CISA KEV, and no public POC has been identified at time of analysis.
Insufficient-entropy secret generation in the crypto-js npm library (all 3.x releases except 3.2.0/3.2.1, i.e. versions < 4.0.0) collapses CryptoJS.lib.WordArray.random() to effective search spaces of only ~2^39 (128-bit request) and ~2^47 (256-bit request), letting attackers brute-force any long-term secret produced by it. Downstream cryptocurrency wallets used this function as the entropy source for BIP39 recovery phrases; Coinspect's 'Ill Bloom' investigation reproduced full key recovery and documented coordinated drain waves that stole a lower-bound of ~$5M in assets as of 13 July 2026. This is not in CISA KEV, but a proof of concept exists and real-world theft has been documented by the researchers.
Predictable API key generation in osTicket 1.18.3 lets remote attackers reconstruct valid staff API keys by exploiting weak MD5-based construction seeded with the request timestamp and client IP address (CWE-331). Because the key is derived from low-entropy, guessable inputs, an attacker who approximates the key creation window can brute-force the key space and gain API access without credentials. Rated CVSS 9.8 by the reporter; no public exploit is identified at time of analysis, though a technical disclosure write-up exists, and CISA SSVC lists exploitation as none but marks the flaw automatable with total technical impact.
Improper API key generation in Sonatype Nexus Repository Manager lets a remote attacker impersonate a targeted user and perform repository operations on their behalf. The flaw stems from insufficient entropy (CWE-331) in format-specific API key realms, so an attacker who can predict or reconstruct a victim's key gains their access without credentials. The vendor (Sonatype) reported and patched the issue in release 3.93.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reduced cryptographic key protection in Silicon Labs' SiXG301 SYMCRYPTO hardware engine (exposed via the Simplicity SDK PSA crypto library) allows an attacker who already has on-device code execution to weaken the engine's Differential Power Analysis (DPA) countermeasures by forcing low-entropy seed values, making AES/hashing keys far easier to recover through subsequent power-analysis side-channel attacks. The flaw affects embedded systems built on the SiXG301 SoC and was reported by Silicon Labs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation also requires physical access to the device for the power measurements.
Weak secret generation in the Authen::TOTP Perl module before version 0.1.1 lets attackers predict TOTP shared secrets because they were built with Perl's non-cryptographic rand() function. Any application relying on this module to seed two-factor authentication produces guessable secrets, undermining the OTP protection it was meant to provide. There is no public exploit identified at time of analysis, and EPSS rates near-zero (0.01%) exploitation probability, but the fix (0.1.1) is confirmed in the vendor changelog.