Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
11 matching advisories · 11 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
medium4.8
CVE-2026-87043

sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready

The entropy-device random number generator in subsys/random/random_entropy_device.c returned early with -ENODEV from rand_get() as soon as device_is_ready() failed, before reaching the non-cryptographic system-timer fallback further down the same function. Because z_impl_sys_rand_get() returns void and discards that error — and the public sys_rand_get() syscall is itself declared void, so it cannot report failure — the caller's output buffer was left untouched and its previous contents were handed back as random data. The thin wrappers make this a plain uninitialized read: sys_rand32_get() declares uint32_t ret;, calls sys_rand_get(&ret, sizeof(ret)) and returns ret.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

zephyrproject · zephyr
low3.1
CVE-2026-120223

Oray Pugongying X5 Pro Session ID session.lua session_get random values

A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently random values. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

Oray · Pugongying X5 Pro
medium6.5
CVE-2026-79981

DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing

The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised (dns_resolve_init_locked() -> register_dispatcher() -> dns_dispatcher_register()), with the local port left at 0 so the stack picks an ephemeral port exactly once. dns_write() then sends every subsequent query from that same socket without re-binding, so the source port is constant for the lifetime of the resolver context while only the 16-bit transaction identifier (ctx->queries[i].id, drawn with sys_rand16_get()) varies per query. RFC 5452 section 9.2 requires both to vary; with a fixed port, an off-path attacker has to guess only the identifier.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

zephyrproject · zephyr
medium4.8
CVE-2026-106074

A flaw in Node.js crypto causes the internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() to be saved into…

A flaw in Node.js crypto causes the internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() to be saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

nodejs · node
medium6.8
CVE-2026-46347

Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy allows the password to be brute-forced by an attacker who can approximate the server-side generation time. Exploiting this finding in isolation requires the victim to have triggered the reset themselves and the attacker to infer the server time from network or email metadata. This issue has been patched in version 26.05.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

intranda · goobi-viewer-core
high8.8
CVE-2026-113071

Use of insufficiently random values in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements…

Use of insufficiently random values in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
critical9.1
CVE-2026-63149

Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()

Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Omnispace · Agora Project
medium4.8
CVE-2026-19735

Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack

The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus a uptime-derived offset, where unique_key is a 128-bit secret filled once by sys_csrand_get(). The return value of that call was discarded and the once guard was latched to true even when the call failed. Because sys_csrand_get() leaves the destination buffer untouched on failure (it deliberately propagates the entropy-driver error rather than filling the buffer), a single failed call left unique_key as its all-zero BSS content for the remainder of the boot, with no retry, no log message and no fallback.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

zephyrproject · zephyr
high7.5
CVE-2026-84606

A privacy issue was addressed with improved handling of identifiers.

A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to identify a user across reinstalls.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apple · iOS and iPadOS / Apple · macOS
medium6.5
CVE-2026-71225

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vector (IV) for each internal data chunk. A remote attacker could potentially exploit this by making an application that uses libkcapi process specially crafted large inputs. This can lead to a significant weakening of data confidentiality, as the repeated IV use can expose relationships in encrypted plaintext, and may also affect data integrity by causing incorrect cryptographic processing.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Stephan Muelle · libkcapi / Red Hat · Red Hat Enterprise Linux 10
medium5.3
CVE-2024-52615

Avahi: avahi wide-area dns uses constant source port

A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

avahi · avahi / Red Hat · Red Hat Enterprise Linux 10