CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

Duplicate Advisory: Langflow: Weak Fernet Key via random.seed()

Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation

Guzzle OAuth Subscriber has insufficient nonce entropy

Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)

Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure

Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values

Apache Druid’s Kerberos authenticator uses a weak fallback secret

Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation

Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content

Withdrawn Advisory: go-mysql affected by go.uuid's Predictable UUID Identifiers

Passeo uses insecure random number generator

matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG

go.uuid has Predictable UUID Identifiers

stormpath/sdk uses Insecure Random Number Generator

Magento 2 Community Cryptographic Flaw

Magento 2 Community Edition Weak PRNG

Ethyca Fides Cryptographically Weak Generation of One-Time Codes for Identity Verification

Magento 2 Community Weak PRNG

Cryptographically Weak PRNG in randomatic

miekg/dns insecurely generates random numbers