CWE-340 Generation of Predictable Numbers or Identifiers
classThe product uses a scheme that generates numbers or identifiers that are more predictable than required.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (67)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-69286US | critical9.8 | Exploit | ||
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assista… | ||||
| CVE-2019-0007US | critical10.0OT elevated | — | ||
The vMX Series software uses a predictable IP ID Sequence Number. This leaves the system as well as clients connecting through the device susceptible to a family of attacks which r… | ||||
| CVE-2026-3256US | critical9.8 | — | ||
HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids.
HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids usi… | ||||
| CVE-2025-15604US | critical9.8 | — | ||
Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions.
In versions 6.06 through 6.16, the random_string function will attempt to… | ||||
| CVE-2024-47945US | critical9.8 | — | ||
The devices are vulnerable to session hijacking due to insufficient
entropy in its session ID generation algorithm. The session IDs are
predictable, with only 32,768 possible val… | ||||
| CVE-2026-40496US | critical9.1OT elevated | — | ||
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are generated using a weak and predictable formula: `md5(APP_KEY… | ||||
| CVE-2024-7558US | high8.0OT elevated | — | ||
JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespa… | ||||
| CVE-2021-31154US | high7.8 | — | ||
pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlin… | ||||
| CVE-2026-95653US | high7.5 | — | ||
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticate… | ||||
| CVE-2025-68701US | high7.5OT elevated | — | ||
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses deterministic AES IV derivation from a passphrase. This vulnerabilit… | ||||
| CVE-2025-62294US | high7.5 | — | ||
SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is able to brute-force all… | ||||
| CVE-2024-52299US | high7.5 | — | ||
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" t… | ||||
| CVE-2021-31228US | high7.5OT elevated | — | ||
An issue was discovered in HCC embedded InterNiche 4.0.1. This vulnerability allows the attacker to predict a DNS query's source port in order to send forged DNS response packets t… | ||||
| CVE-2021-29499US | high7.5OT elevated | — | ||
SIF is an open source implementation of the Singularity Container Image Format. The `siftool new` command and func siftool.New() produce predictable UUID identifiers due to insecur… | ||||
| CVE-2025-0218US | high7.1OT elevated | — | ||
When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficiently seeded random numb… | ||||
| CVE-2026-3255US | medium6.5 | — | ||
HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function.
The HTTP::Session2 session id generator returns a SHA-1 hash seeded… | ||||
| CVE-2011-3871US | medium6.2 | — | ||
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or tric… | ||||
| CVE-2016-2201US | medium5.3 | — | ||
Siemens SIMATIC S7-1500 CPU devices before 1.8.3 allow remote attackers to bypass a replay protection mechanism via packets on TCP port 102. | ||||
| CVE-2024-10603US | medium5.3 | — | ||
Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an external attacker in some circumstances. | ||||
| CVE-2026-28810US | low3.7 | — | ||
Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.
The built-in DNS resolver (inet_res) us… | ||||
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan