CWE-341
20 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 20Published CVEs20 of them scored
- 10Last 12 monthspublished in the last year
- 5Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-94456
Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
GitroomHQ · postiz-app
Critical9.1 - CVE-2026-87913
Missing S3 bucket ownership verification in the AWS Security Agent MCP server
AWS · AWS Security Agent MCP server
Medium5.1 - CVE-2026-87912
Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops
AWS · AWS Security Agent plugin
Medium5.1 - CVE-2026-19565
Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey
Apache-AppSamurai
Low3.7 - CVE-2026-15571
Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client
Red Hat · Red Hat build of Keycloak 26.6
High7.3 - CVE-2026-38968
ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak…
Product not named
Critical9.8 - CVE-2026-36609
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source…
Product not named
High7.3 - CVE-2026-5081
Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure
CHORNY · Apache::Session::Generate::ModUniqueId
Critical9.1 - CVE-2026-42365
GeoVision LPC2011/LPC2211 Web Interface guessable session cookie vulnerability
GeoVision Inc. · GV-LPC2011/LPC2211
High8.6 - CVE-2026-40164
jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed
jqlang · jq
High7.5