CWE-330 Use of Insufficiently Random Values

Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue

Spring Framework Predictable Session ID in WebSocket Module

AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle

Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection

RabbitMQ has predictable credential obfuscation seed value used in Shovel and Federation plugins

Netty: QUIC stateless reset token material exposed through header-visible connection IDs

Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures

Vantage6 Server JWT secret not cryptographically secure

Gradio has an Open Redirect in its OAuth Flow

ImageMagick: Information Disclosure in PasskeyEncipherImage via AES-CTR nonce reuse

Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

Langchain-Chatchat Uses Insufficiently Random Values

Spring Boot's random value property source uses a weak PRNG unsuitable for secrets

DNN: Same HostGUID for all new installs

Duplicate Advisory: OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter

openssl-encrypt has non-cryptographic PRNG used for steganography pixel selection

crypto-js uses insecure random numbers

Fleet: Device lock PIN can be predicted if lock time is known

OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing

Triton VM has a Soundness Vulnerability due to Improper Sampling of Randomness

Jervis Has Weak Random for Timing Attack Mitigation

gokey allows secret recovery from a seed file without the master password

Discovery uses the same AES/GCM Nonce throughout the session