CWE-338

CVEs per yearBy the year they were published

1. 20204
2. 202116
3. 20211
4. 20212
5. 20221
6. 202314
7. 202415
8. 202416
9. 202539
10. 202525
11. 20251
12. 202670

Newest CVEs

• CVE-2026-121553

  Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())

  cotonti · cotonti

  Medium6.3
• CVE-2026-118986

  CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()

  CallBackery

  Not scored
• CVE-2026-102813

  Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305

  TP-Link Systems Inc. · RE305 v3

  Medium6.1
• CVE-2026-19742

  IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key

  zephyrproject · zephyr

  Low3.7
• CVE-2026-112240

  Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

  TYPO3 · Extension "TYPO3 Fluid-Form by coding.ms"

  Medium6.3
• CVE-2026-112041

  diem-project diem dmString.php random weak prng

  diem-project · diem

  Medium6.3
• CVE-2026-107612

  World-accessible IPC shared memory with predictable name in TightVNC Server

  GlavSoft · TightVNC

  High7.8
• CVE-2026-107283

  AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

  AsyncHttpClient · async-http-client

  Low3.7
• CVE-2026-104356

  PictShare < 3.7.1 Predictable Delete Code via rand()

  HaschekSolutions · pictshare

  High8.2
• CVE-2026-53953

  GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover

  GetSimpleCMS-CE · GetSimpleCMS-CE

  Critical9.1

Vendors it comes up for most

1. Qualcomm, Inc.4
2. Apache Software Foundation3
3. TOKUHIROM3
4. Fortinet2
5. Fortra2
6. GRYPHON2
7. HAYAJO2
8. IBM2
9. Jenkins Project2
10. MIK2