CWE-330: CWE-330
Yearly Trend
Top Affected Vendors
All CWE-330 CVEs (62)
FreeScout's authentication system uses a predictable, static token that never expires. If an attacker obtains the Laravel APP_KEY (commonly exposed), ...
Feb 25, 2026This vulnerability in NervesHub allows attackers to brute-force user API tokens due to their predictable format, potentially granting unauthorized acc...
Jan 22, 2026The PSW Front-end Login & Registration WordPress plugin has a critical privilege escalation vulnerability that allows unauthenticated attackers to res...
May 31, 2025MileSight DeviceHub uses insufficiently random values for authentication, potentially allowing attackers to bypass authentication mechanisms. This aff...
Jun 2, 2024CVE-2020-27630 is a vulnerability in Silicon Labs uC/TCP-IP 3.6.0 where TCP Initial Sequence Numbers (ISNs) are generated with insufficient randomness...
Oct 10, 2023This vulnerability in CBOT Chatbot uses a weak pseudo-random number generator (PRNG) that allows attackers to recreate cryptographic keys. This enable...
May 25, 2023This vulnerability affects Siemens SCALANCE industrial network switches. It allows unauthenticated remote attackers to brute-force session IDs and hij...
Apr 12, 2022This vulnerability allows remote attackers to efficiently guess administrative authentication tokens in FortiMail systems by observing certain system ...
Mar 1, 2022This vulnerability in TP-Link TL-WA850RE Wi-Fi range extenders allows attackers to gain administrative access by exploiting predictable session keys. ...
Feb 18, 2022This vulnerability allows unauthenticated attackers to change any user's password in Premiumdatingscript 4.2.7.7 due to improper access controls in th...
Dec 9, 2021CVE-2021-38606 is a vulnerability in reNgine (a reconnaissance framework) where predictable directory names allow attackers to access sensitive files....
Aug 12, 2021CVE-2021-27200 is a critical authentication bypass vulnerability in WoWonder's password recovery system. Attackers can predict password reset codes ba...
Jun 11, 2021This vulnerability in the nanorand Rust crate causes random number generators to return all zero values due to integer truncation. This affects any Ru...
Dec 31, 2020This vulnerability allows unauthorized users to bypass authentication and gain access to Schneider Electric Smartlink, PowerTag, and Wiser Series Gate...
Dec 1, 2020CVE-2020-27743 is a vulnerability in libtac within pam_tacplus where insufficient randomness checking for session IDs could allow attackers to predict...
Oct 26, 2020CVE-2020-27633 is a vulnerability in FNET 4.6.3 where TCP Initial Sequence Numbers (ISNs) are generated with insufficient randomness, allowing attacke...
Oct 10, 2023CVE-2020-27635 is a vulnerability in PicoTCP 1.7.0 where TCP Initial Sequence Numbers (ISNs) are generated with insufficient randomness, allowing atta...
Oct 10, 2023This vulnerability in the KASAGO TCP/IP stack allows attackers to predict TCP Initial Sequence Numbers (ISNs) due to insufficient randomness. Attacker...
Feb 10, 2023Dell PowerScale OneFS versions 8.2.2 through 9.3.x contain a predictable file name vulnerability that allows unprivileged network attackers to potenti...
Apr 8, 2022This vulnerability allows attackers to efficiently calculate private RSA keys from public TLS certificates by exploiting weak RSA key generation in th...
Mar 14, 2022This vulnerability in wolfSSL allows attackers to decrypt TLS/DTLS traffic when using AES-CBC or DES3 without AEAD protection. It affects systems usin...
Jan 18, 2022This vulnerability allows attackers on the same network to bypass authentication on TP-Link TL-WR940N routers by exploiting predictable session sequen...
Mar 29, 2023This vulnerability allows attackers to forge authentication requests against CKAN instances using default Docker images. It affects users who deployed...
Feb 3, 2023CVE-2022-31034 is a vulnerability in Argo CD's OAuth2/OIDC login flows where insufficiently random values in parameters could allow attackers to poten...
Jun 27, 2022This CVE describes a session hijacking vulnerability in iDRAC9's IPMI interface that allows remote attackers to take over authenticated sessions. Succ...
Jun 29, 2024Piwigo versions 14.x have a weak secret key generation vulnerability during installation. Attackers can brute-force the secret key in about one hour, ...
Feb 24, 2026Jervis versions before 2.2 use java.util.Random() for timing attack mitigation, which is not cryptographically secure. This vulnerability could allow ...
Jan 13, 2026A regression in RNP v0.18.0 causes public-key encrypted session keys to always be all-zero bytes, allowing anyone to decrypt data encrypted with publi...
Nov 21, 2025CVE-2024-47188 is a denial-of-service vulnerability in Suricata's thash implementation where missing random seed initialization allows attackers to pr...
Oct 16, 2024A vulnerability in AdaCore's Ada Web Server (AWS) 20.0 allows attackers to escalate privileges and hijack sessions due to insufficient randomness in t...
Sep 25, 2024This vulnerability in Ethernut Nut/OS allows attackers to predict TCP Initial Sequence Numbers (ISNs) due to insufficient randomness in generation. Th...
Oct 10, 2023This vulnerability in Microsoft Azure Kubernetes Service allows authenticated users to escalate privileges within Kubernetes clusters. Attackers could...
Sep 12, 2023This vulnerability allows unauthenticated attackers to view guest orders in Magento LTS by brute-forcing a 6-character hexadecimal 'protect_code' valu...
Sep 11, 2023This authentication bypass vulnerability in Open Automation Software OAS Platform allows attackers to decrypt sensitive information by sniffing networ...
Sep 5, 2023This vulnerability allows attackers to predict authorization tokens in OX App Suite's oAuth Authorization Service, enabling them to intercept and hija...
Aug 2, 2023This vulnerability in Netflix Lemur allows attackers to guess default credentials due to insufficient randomness in generation. Attackers could gain u...
Apr 19, 2023CVE-2022-28355 is a vulnerability in Scala.js where the randomUUID function generates predictable UUID values instead of cryptographically secure rand...
Apr 2, 2022The Simple JWT Login WordPress plugin before version 3.3.0 uses PHP's str_shuffle function to generate passwords for new user accounts, which creates ...
Dec 27, 2021This vulnerability in NetBSD's IPv4 ID generation algorithm uses predictable values instead of cryptographically secure random numbers. This allows at...
Dec 25, 2021This vulnerability in Android's ClientModeImpl.java allows a proximal attacker to track a device via a unique identifier, leading to remote informatio...
Jun 11, 2021This vulnerability allows attackers to predict the one-time password for the undocumented 'mofidev' system account on affected Mofi routers. Attackers...
Feb 1, 2021CVE-2022-39216 is a vulnerability in Combodo iTop where password reset tokens are generated without sufficient randomness, allowing attackers to predi...
Mar 14, 2023This vulnerability in F5 BIG-IP's Traffic Management Microkernel allows attackers to bypass UDP source port randomization, enabling them to scan open ...
May 5, 2022This Linux kernel vulnerability allows remote attackers to bypass UDP source port randomization by exploiting flaws in ICMP error processing. Attacker...
Feb 18, 2022This vulnerability in Qualcomm chipsets allows information disclosure when Address Space Layout Randomization (ASLR) fails to properly randomize memor...
Jul 1, 2024This vulnerability allows attackers to brute-force PIN codes offline due to improper JPAKE implementation where random values are initialized to known...
May 3, 2023This vulnerability in Undici's multipart/form-data boundary generation allows attackers to predict and tamper with requests when an application sends ...
Jan 21, 2025This vulnerability in Cisco ASA and FTD software allows unauthenticated remote attackers to disrupt VPN authentication sessions by exploiting insuffic...
Oct 23, 2024This vulnerability allows attackers who obtain SolaX device registration numbers to connect to the SolaX Cloud MQTT server and impersonate legitimate ...
Feb 12, 2026This vulnerability allows unauthenticated attackers to generate valid authentication tokens for WordPress sites using the Simply Schedule Appointments...
Jan 6, 2026About CWE-330 (CWE-330)
Our database tracks 62 CVEs classified as CWE-330, with 21 rated critical and 25 rated high severity. The average CVSS score for CWE-330 vulnerabilities is 7.9.
External reference: View CWE-330 on MITRE CWE →
Monitor CWE-330 Vulnerabilities
Get alerted when new CWE-330 CVEs affect your infrastructure.
Start Monitoring Free