Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then calls randomize with an empty output buffer while the generator is unseeded can cause AutoSeeded_RNG to mark itself seeded without consulting the configured entropy source. On builds without BOTAN_HAS_SYSTEM_RNG, the fallback uses only a clock value and process ID, so a later non-empty request can produce output from predictable state. This issue is fixed in version 3.13.0.
CVE-2026-11730 is a low-severity vulnerability in the NETGEAR EX3700 WiFi extender models that results from incorrect usage of seeds in the pseudo-random number generator. This flaw allows a network-adjacent attacker with network access, such as having WiFi credentials, to predict valid session identifiers and hijack an authenticated administrator session on the device's web management portal.
Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes.
When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced.
Secrets generated in multiprocess applications are predictable across processes.
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.
When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.
Secrets generated in multiprocess applications are predictable across processes.
CryptX versions before 0.088 for Perl contain a vulnerability where the Crypt::PK pseudo-random number generator (PRNG) state is not reseeded after a process fork. This causes child processes to share identical PRNG states, leading to identical outputs in cryptographic operations such as key generation and signing. Specifically, ECDSA or DSA signatures generated by different processes can leak the private key due to nonce reuse. This affects preforking services like the Starman web server that load Crypt::PK::* objects before forking. The vulnerability has a high severity with a CVSS score of 7.5.
CVE-2026-3503 is a medium severity vulnerability in wolfSSL's wolfCrypt library version 5.8.2 affecting ARM Cortex-M microcontrollers. The flaw involves incorrect usage of seeds in the pseudo-random number generator (PRNG) within post-quantum cryptographic implementations (ML-KEM and ML-DSA). Physical attackers can induce transient faults to corrupt or redirect seed or pointer values during the Keccak-based expansion process, potentially compromising key material or cryptographic outcomes. Exploitation requires physical access and high attack complexity, with no user interaction needed. This vulnerability impacts confidentiality due to possible key leakage but has limited scope and availability impact. No known exploits are reported in the wild. Organizations using affected wolfSSL versions on ARM Cortex-M devices should prioritize patching or apply hardware-level protections against fault injection attacks.
Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications.
This issue affects Command Centre Server:
9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.