# CWE-340.

Every Advisory and CVE whose sources give the weakness CWE-340, newest first.

## Records, newest first

- [Ivanti Connect Secure: Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and…](https://agentprime.io/advisories/CVE-2026-118527.md)
  `CVE-2026-118527` · CVE record: Ivanti Connect Secure · CVSS 4.3 Medium · Critical (KEV) · In CISA KEV · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-340
- [Bucket Squatting in Cloud Run MCP leads to Service Account Takeover](https://agentprime.io/advisories/CVE-2026-85297.md)
  `CVE-2026-85297` · CVE record: Google Cloud Cloud Run MCP · CVSS 7.7 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-340
- [Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS](https://agentprime.io/advisories/CVE-2026-79980.md)
  `CVE-2026-79980` · CVE record: zephyrproject zephyr · CVSS 5.6 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-340
- [Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset](https://agentprime.io/advisories/CVE-2026-46347.md)
  `CVE-2026-46347` · CVE record: intranda goobi-viewer-core · CVSS 6.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS, CWE-340, CWE-640
- [Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset](https://agentprime.io/advisories/CVE-2026-46346.md)
  `CVE-2026-46346` · CVE record: intranda goobi-viewer-core · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS, CWE-340, CWE-640
- [Botslab G980H Dashcams Generation of Predictable Numbers or Identifiers](https://agentprime.io/advisories/CVE-2026-85496.md)
  `CVE-2026-85496` · CVE record: Botslab G980H · CVSS 7.7 High · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-340
- [Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token](https://agentprime.io/advisories/CVE-2026-95653.md)
  `CVE-2026-95653` · CVE record: concretecms-community-store community_store · CVSS 8.7 High · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-340
- [Generation of Predictable Email Confirmation Token in ATutor](https://agentprime.io/advisories/CVE-2026-64964.md)
  `CVE-2026-64964` · CVE record: ATutor ATutor · CVSS 6.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-340
- [Weak File Name Generation in vsDesk](https://agentprime.io/advisories/CVE-2025-14602.md)
  `CVE-2025-14602` · CVE record: vsDesk vsDesk · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-340, CWE-377
- [OpnForm Editable Submission Secret Derivation via Empty Hashids Salt](https://agentprime.io/advisories/CVE-2026-75106.md)
  `CVE-2026-75106` · CVE record: OpnForm OpnForm · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-340
- [Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable](https://agentprime.io/advisories/CVE-2026-13577.md)
  `CVE-2026-13577` · CVE record · CVSS 8.2 High · Not analysed yet · Published 20 Jul 2026 · Tags: Weak cryptography or TLS, CWE-340
- [An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2.](https://agentprime.io/advisories/CVE-2026-47085.md)
  `CVE-2026-47085` · CVE record: cyrusimap Cyrus IMAP · CVSS 4.0 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-340
- [CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources](https://agentprime.io/advisories/CVE-2026-56016.md)
  `CVE-2026-56016` · CVE record: MARKSTOS CGI::Session::ID::md5 · CVSS 5.9 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Setracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or Identifiers](https://agentprime.io/advisories/CVE-2026-9219.md)
  `CVE-2026-9219` · CVE record: Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker · CVSS 8.3 High · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-340
- [Account Takeover via Predictable SSO Ticket Generation](https://agentprime.io/advisories/CVE-2026-11374.md)
  `CVE-2026-11374` · CVE record: zohocorp manageengine_adselfservice_plus and 3 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2026 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-340
- [Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter](https://agentprime.io/advisories/CVE-2026-9733.md)
  `CVE-2026-9733` · CVE record: HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely](https://agentprime.io/advisories/CVE-2026-9692.md)
  `CVE-2026-9692` · CVE record: HAYAJO Mojolicious::Sessions::Storable · CVSS 5.3 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Naxclow IoT Platform Generation of Predictable Numbers or Identifiers](https://agentprime.io/advisories/CVE-2026-42932.md)
  `CVE-2026-42932` · CVE record: Naxclow Smart Doorbell X3 and 3 more · CVSS 6.9 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-340
- [Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port](https://agentprime.io/advisories/GHSA-xmv7-r254-6q78.md)
  `GHSA-xmv7-r254-6q78`, `CVE-2026-45673` · Maven `io.netty:netty-resolver-dns`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 6.8 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids](https://agentprime.io/advisories/CVE-2026-8503.md)
  `CVE-2026-8503` · CVE record: GUIMARD Apache::Session::Generate::SHA256 · CVSS 6.5 Medium · Not analysed yet · Published 15 May 2026 · Tags: Weak cryptography or TLS, CWE-340
- [WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely](https://agentprime.io/advisories/CVE-2026-5084.md)
  `CVE-2026-5084` · CVE record: ASPEER WebDyne::Session · CVSS 6.5 Medium · Not analysed yet · Published 11 May 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure](https://agentprime.io/advisories/CVE-2026-5081.md)
  `CVE-2026-5081` · CVE record: CHORNY Apache::Session::Generate::ModUniqueId · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 May 2026 · Tags: CWE-340, CWE-341
- [Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely](https://agentprime.io/advisories/CVE-2026-5080.md)
  `CVE-2026-5080` · CVE record: BIGPRESH Dancer::Session::Abstract · CVSS 5.9 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: Weak cryptography or TLS, CWE-340
- [FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force](https://agentprime.io/advisories/CVE-2026-40496.md)
  `CVE-2026-40496` · CVE record: freescout-help-desk freescout · CVSS 8.8 High · Not analysed yet · Published 21 Apr 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Solstice::Session versions through 1440 for Perl generates session ids insecurely](https://agentprime.io/advisories/CVE-2026-5085.md)
  `CVE-2026-5085` · CVE record: MCRAWFOR Solstice::Session · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Apr 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Ado::Sessions versions through 0.935 for Perl generates insecure session ids](https://agentprime.io/advisories/CVE-2026-5083.md)
  `CVE-2026-5083` · CVE record: BEROV Ado::Sessions · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id](https://agentprime.io/advisories/CVE-2026-5082.md)
  `CVE-2026-5082` · CVE record: TOKUHIROM Amon2::Plugin::Web::CSRFDefender · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver](https://agentprime.io/advisories/CVE-2026-28810.md)
  `CVE-2026-28810` · CVE record: Erlang OTP · CVSS 6.3 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-340
- [Multiple Vulnerabilities in IBM Concert Software](https://agentprime.io/advisories/CVE-2025-13044.md)
  `CVE-2025-13044` · CVE record: IBM Concert · CVSS 6.2 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-340
- [HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids](https://agentprime.io/advisories/CVE-2026-3256.md)
  `CVE-2026-3256` · CVE record: KTAT HTTP::Session · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Mar 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions](https://agentprime.io/advisories/CVE-2025-15604.md)
  `CVE-2025-15604` · CVE record: TOKUHIROM Amon2 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Mar 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit](https://agentprime.io/advisories/GHSA-xfhr-q72q-jcrj.md)
  `GHSA-xfhr-q72q-jcrj`, `CVE-2026-4269`, `PYSEC-2026-2396` · PyPI `bedrock-agentcore-starter-toolkit`: affected `<0.1.13`, fixed in `0.1.13` · CVSS 5.8 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: CWE-283, CWE-340
- [Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id](https://agentprime.io/advisories/CVE-2025-40931.md)
  `CVE-2025-40931` · CVE record: CHORNY Apache::Session::Generate::MD5 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely](https://agentprime.io/advisories/CVE-2025-40926.md)
  `CVE-2025-40926` · CVE record: KAZEBURO Plack::Middleware::Session::Simple · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Weak cryptography or TLS, CWE-340
- [HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function](https://agentprime.io/advisories/CVE-2026-3255.md)
  `CVE-2026-3255` · CVE record: TOKUHIROM HTTP::Session2 · CVSS 6.5 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Apache::SessionX versions through 2.01 for Perl create insecure session id](https://agentprime.io/advisories/CVE-2025-40932.md)
  `CVE-2025-40932` · CVE record: GRICHTER Apache::SessionX · CVSS 8.2 High · Not analysed yet · Published 26 Feb 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Google Cloud Vertex AI has a a vulnerability involving predictable bucket naming](https://agentprime.io/advisories/GHSA-wh2j-26j7-9728.md)
  `GHSA-wh2j-26j7-9728`, `CVE-2026-2473`, `PYSEC-2026-2500` · PyPI `google-cloud-aiplatform`: affected `>=1.21.0, <1.133.0`, fixed in `1.133.0` · CVSS 7.7 High · Not analysed yet · Published 20 Feb 2026 · Tags: CWE-340
- [Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids](https://agentprime.io/advisories/CVE-2026-2439.md)
  `CVE-2026-2439` · CVE record: BVA Concierge::Sessions · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Feb 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Jervis has Deterministic AES IV Derivation from Passphrase](https://agentprime.io/advisories/GHSA-crxp-chh4-9ghp.md)
  `GHSA-crxp-chh4-9ghp`, `CVE-2025-68701` · Maven `net.gleske:jervis`: affected `<2.2`, fixed in `2.2` · CVSS 8.7 High · Not analysed yet · Published 13 Jan 2026 · Tags: Weak cryptography or TLS, CWE-340
- [RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-69286.md)
  `CVE-2025-69286` · CVE record: infiniflow ragflow · CVSS 8.9 High · Not analysed yet · Published 31 Dec 2025 · Tags: CWE-340
- [Predictable Generation of Password Recovery Token](https://agentprime.io/advisories/CVE-2025-62294.md)
  `CVE-2025-62294` · CVE record: SOPlanning SOPlanning · CVSS 8.7 High · Not analysed yet · Published 20 Nov 2025 · Tags: CWE-340
- [BIG-IP TMM vulnerability](https://agentprime.io/advisories/CVE-2025-58424.md)
  `CVE-2025-58424` · CVE record: F5 BIG-IP · CVSS 6.3 Medium · Not analysed yet · Published 15 Oct 2025 · Tags: CWE-340
- [Weak Session Token used in Automation Runtime SDM](https://agentprime.io/advisories/CVE-2025-3449.md)
  `CVE-2025-3449` · CVE record: B&R Industrial Automation GmbH Automation Runtime · CVSS 2.3 Low · Not analysed yet · Published 7 Oct 2025 · Tags: CWE-340
- [YoSmart YoLink API: The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a…](https://agentprime.io/advisories/CVE-2025-59452.md)
  `CVE-2025-59452` · CVE record: YoSmart YoLink API · CVSS 5.8 Medium · Not analysed yet · Published 6 Oct 2025 · Tags: CWE-340
- [Starch versions 0.14 and earlier generate session ids insecurely](https://agentprime.io/advisories/CVE-2025-40925.md)
  `CVE-2025-40925` · CVE record: BLUEFEET Starch · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Sept 2025 · Tags: Weak cryptography or TLS, CWE-340
- [Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely](https://agentprime.io/advisories/CVE-2025-40933.md)
  `CVE-2025-40933` · CVE record: KGOLDOV Apache::AuthAny · CVSS 7.5 High · Not analysed yet · Published 17 Sept 2025 · Tags: Weak cryptography or TLS, CWE-340
- [predictable WebSocket mask](https://agentprime.io/advisories/CVE-2025-10148.md)
  `CVE-2025-10148` · CVE record: curl curl · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2025 · Tags: CWE-340
- [Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces](https://agentprime.io/advisories/CVE-2025-40920.md)
  `CVE-2025-40920` · CVE record: ETHER Catalyst::Authentication::Credential::HTTP · CVSS 8.6 High · Not analysed yet · Published 11 Aug 2025 · Tags: Weak cryptography or TLS, CWE-340
- [Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely](https://agentprime.io/advisories/CVE-2025-40924.md)
  `CVE-2025-40924` · CVE record: HAARG Catalyst::Plugin::Session · CVSS 6.5 Medium · Not analysed yet · Published 17 Jul 2025 · Tags: Weak cryptography or TLS, CWE-340
- [Authen::DigestMD5 versions 0.01 through 0.04 for Perl generate the cnonce insecurely](https://agentprime.io/advisories/CVE-2025-40919.md)
  `CVE-2025-40919` · CVE record: SALVA Authen::DigestMD5 · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Weak cryptography or TLS, CWE-340
- [Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely](https://agentprime.io/advisories/CVE-2025-40918.md)
  `CVE-2025-40918` · CVE record: EHUELS Authen::SASL::Perl::DIGEST_MD5 · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Weak cryptography or TLS, CWE-340
- [Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely](https://agentprime.io/advisories/CVE-2025-40923.md)
  `CVE-2025-40923` · CVE record: MIYAGAWA Plack::Middleware::Session · CVSS 7.3 High · Not analysed yet · Published 16 Jul 2025 · Tags: Weak cryptography or TLS, CWE-340
- [Google gVisor: Weaknesses in the generation of TCP/UDP source ports and some other header values in…](https://agentprime.io/advisories/CVE-2024-10603.md)
  `CVE-2024-10603` · CVE record: Google gVisor · CVSS 6.3 Medium · Not analysed yet · Published 30 Jan 2025 · Tags: CWE-340
- [pgAgent scheduled batch job scripts are created in a predictable temporary directory potentially allowing a denial of service](https://agentprime.io/advisories/CVE-2025-0218.md)
  `CVE-2025-0218` · CVE record: pgAgent · CVSS 5.5 Medium · Not analysed yet · Published 7 Jan 2025 · Tags: CWE-340
- [Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock](https://agentprime.io/advisories/CVE-2024-12034.md)
  `CVE-2024-12034` · CVE record: webfactory Advanced Google reCAPTCHA · CVSS 5.3 Medium · Not analysed yet · Published 24 Dec 2024 · Tags: CWE-340
- [Salt preflight script could be attacker controlled](https://agentprime.io/advisories/GHSA-4277-m35q-7c9w.md)
  `GHSA-4277-m35q-7c9w`, `CVE-2023-34049`, `PYSEC-2026-1892` · PyPI `salt`: affected `<3005.4 || >=3006.0rc1, <3006.4`, fixed in `3005.4`, `3006.4` · CVSS 6.7 Medium · Not analysed yet · Published 14 Nov 2024 · Tags: CWE-340
- [The PDF viewer macro allows accessing any attachment without access right checks](https://agentprime.io/advisories/CVE-2024-52299.md)
  `CVE-2024-52299` · CVE record: xwikisas macro-pdfviewer · CVSS 7.5 High · Not analysed yet · Published 13 Nov 2024 · Tags: CWE-340
- [Predictable Session ID](https://agentprime.io/advisories/CVE-2024-47945.md)
  `CVE-2024-47945` · CVE record: RITTAL GmbH & Co. KG IoT Interface & CMC III Processing Unit · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2024 · Tags: CWE-340
- [JUJU_CONTEXT_ID is a predictable authentication secret in github.com/juju/juju](https://agentprime.io/advisories/GHSA-mh98-763h-m9v4.md)
  `GHSA-mh98-763h-m9v4`, `CVE-2024-7558`, `GO-2024-3173` · Go `github.com/juju/juju`: affected `<0.0.0-20240826044107-ecd7e2d0e986`, fixed in `0.0.0-20240826044107-ecd7e2d0e986` · CVSS 8.7 High · Not analysed yet · Published 9 Oct 2024 · Tags: Hard-coded credentials, CWE-337, CWE-340
- [Generation of predictable identifiers issue exists in Cente middleware TCP/IP Network Series.](https://agentprime.io/advisories/CVE-2024-28957.md)
  `CVE-2024-28957` · CVE record: DMG MORI Digital Co., LTD. and NEXT Co., Ltd. Cente TCP/IPv4 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 15 Apr 2024 · Tags: CWE-340

Older: <https://agentprime.io/advisories/tag/cwe-340.md?cursor=WyIyMDI0LTA0LTE1VDEwOjQ4OjU5Ljk3ODAwMFoiLCJDVkUtMjAyNC0yODk1NyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-340>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-340/>. Everything for agents: <https://agentprime.io/llms.txt>.