# CWE-337.

Every Advisory and CVE whose sources give the weakness CWE-337, newest first.

## Records, newest first

- [Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token](https://agentprime.io/advisories/CVE-2026-18451.md)
  `CVE-2026-18451` · CVE record: SMCI MBD-X12SPI · CVSS 3.1 Low · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-337
- [XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key](https://agentprime.io/advisories/CVE-2026-55889.md)
  `CVE-2026-55889` · CVE record: flatpak xdg-desktop-portal · CVSS 8.3 High · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS, CWE-337
- [HPE NonStop MODULAR NSJ - Vulnerability in Random Number Generation](https://agentprime.io/advisories/CVE-2026-73794.md)
  `CVE-2026-73794` · CVE record: Hewlett Packard Enterprise HPE NonStop MODULAR NSJ · CVSS 4.6 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-337
- [ASUS Router: A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing…](https://agentprime.io/advisories/CVE-2026-19396.md)
  `CVE-2026-19396` · CVE record: ASUS Router · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-337
- [Predictable Seed in Pseudo-Random Number Generator (PRNG) in Digital Watchdog VMAX DVR and NVR Product Lineups](https://agentprime.io/advisories/CVE-2026-66372.md)
  `CVE-2026-66372` · CVE record: Digital Watchdog VMAX A1 G4 DVR and 4 more · CVSS 7.6 High · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-337
- [CoreDNS Loop Detection Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-h75p-j8xm-m278.md)
  `GHSA-h75p-j8xm-m278`, `CVE-2026-26018`, `GO-2026-4635` · Go `github.com/coredns/coredns`: affected `<1.14.2`, fixed in `1.14.2` · CVSS 7.5 High · Not analysed yet · Published 6 Mar 2026 · Tags: Denial of service, CWE-337, CWE-1241
- [PEAR Has a Predictable Verification Hash in Election Account Requests](https://agentprime.io/advisories/CVE-2026-25235.md)
  `CVE-2026-25235` · CVE record: pear pearweb · CVSS 8.2 High · Not analysed yet · Published 3 Feb 2026 · Tags: CWE-337
- [Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl](https://agentprime.io/advisories/GHSA-gr7h-xw4f-wh86.md)
  `GHSA-gr7h-xw4f-wh86`, `CVE-2025-62710` · Maven `org.sakaiproject.kernel:sakai-kernel-impl`: affected `<=23.3`, no fixed version yet · CVSS 5.9 Medium · Not analysed yet · Published 22 Oct 2025 · Tags: CWE-337
- [AutomationDirect CLICK PLUS Predictable Seed in Pseudo-Random Number Generator](https://agentprime.io/advisories/CVE-2025-55069.md)
  `CVE-2025-55069` · CVE record: AutomationDirect CLICK PLUS C0-0x CPU firmware and 2 more · CVSS 8.7 High · Not analysed yet · Published 23 Sept 2025 · Tags: CWE-337
- [Intel(R) TDX: Predictable Seed in Pseudo-Random Number Generator (PRNG) in the firmware for some…](https://agentprime.io/advisories/CVE-2025-20613.md)
  `CVE-2025-20613` · CVE record: Intel(R) TDX · CVSS 2.0 Low · Not analysed yet · Published 12 Aug 2025 · Tags: CWE-337
- [Predictable Seed in Pseudo-Random Number Generator (PRNG) in Tigo Energy Cloud Connect Advanced](https://agentprime.io/advisories/CVE-2025-7770.md)
  `CVE-2025-7770` · CVE record: Tigo Energy Cloud Connect Advanced · CVSS 8.7 High · Not analysed yet · Published 6 Aug 2025 · Tags: CWE-337
- [JUJU_CONTEXT_ID is a predictable authentication secret in github.com/juju/juju](https://agentprime.io/advisories/GHSA-mh98-763h-m9v4.md)
  `GHSA-mh98-763h-m9v4`, `CVE-2024-7558`, `GO-2024-3173` · Go `github.com/juju/juju`: affected `<0.0.0-20240826044107-ecd7e2d0e986`, fixed in `0.0.0-20240826044107-ecd7e2d0e986` · CVSS 8.7 High · Not analysed yet · Published 9 Oct 2024 · Tags: Hard-coded credentials, CWE-337, CWE-340
- [Duplicate Advisory: Juju makes Use of Weak Credentials](https://agentprime.io/advisories/GHSA-phh4-3hmm-24rx.md)
  `GHSA-phh4-3hmm-24rx` · Go `github.com/juju/juju`: affected `<0.0.0-20241001032836-2af7bd8e310b`, fixed in `0.0.0-20241001032836-2af7bd8e310b` · CVSS 8.7 High · Withdrawn · Not analysed yet · Published 2 Oct 2024 · Tags: Weak cryptography or TLS, Hard-coded credentials, CWE-337
- [cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code](https://agentprime.io/advisories/GHSA-rgrf-6mf5-m882.md)
  `GHSA-rgrf-6mf5-m882`, `CVE-2024-22194`, `PYSEC-2024-5`, `PYSEC-2024-6` · PyPI `case-utils` and 1 more: affected `>=0.5.0, <0.5.1 || >=0.6.0, <0.6.1 || >=0.7.0, <0.7.1 || >=0.8.0, <0.8.1 || >=0.9.0, <0.9.1 || >=0.10.0, <0.10.1 || >=0.11.0, <0.11.1 || >=0.12.0, <0.12.1 || >=0.13.0, <0.13.1 || >=0.14.0, <0.14.1`, fixed in `0.5.1`, `0.6.1`, `0.7.1`, `0.8.1`, `0.9.1`, `0.10.1`, `0.11.1`, `0.12.1`, `0.13.1`, `0.14.1` · CVSS 2.2 Low · Not analysed yet · Published 11 Jan 2024 · Tags: CWE-215, CWE-337
- [Resource exposure in Ubuntu Budgie Budgie Extras](https://agentprime.io/advisories/CVE-2023-49343.md)
  `CVE-2023-49343` · CVE record: Ubuntu Budgie Budgie Extras · CVSS 6.0 Medium · Not analysed yet · Published 14 Dec 2023 · Tags: Information disclosure, CWE-337
- [Authentication Bypass Vulnerability in Web Server Function on MELSEC Series](https://agentprime.io/advisories/CVE-2022-40267.md)
  `CVE-2022-40267` · CVE record: Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-32MT/ES and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 20 Jan 2023 · Tags: CWE-337
- [enigmaX Scrambling Table main.c getSeed prng seed](https://agentprime.io/advisories/CVE-2016-15006.md)
  `CVE-2016-15006` · CVE record: enigmaX · CVSS 3.7 Low · Not analysed yet · Published 2 Jan 2023 · Tags: CWE-337
- [Dell PowerScale OneFS: Dell PowerScale OneFS, versions 8.2.x-9.3.x…](https://agentprime.io/advisories/CVE-2022-26852.md)
  `CVE-2022-26852` · CVE record: Dell PowerScale OneFS · CVSS 8.1 High · Not analysed yet · Published 8 Apr 2022 · Tags: CWE-337
- [Epignosis: A predictable seed vulnerability exists in the password reset functionality of Epignosis…](https://agentprime.io/advisories/CVE-2020-28597.md)
  `CVE-2020-28597` · CVE record: Epignosis · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2021 · Tags: CWE-337

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-337>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-337/>. Everything for agents: <https://agentprime.io/llms.txt>.