CVE-2026-11702
Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised bef
CVSS
7.5
High
EPSS
0.5%
p43
KEV
—
Exploit Today
13
0-100
Published: Jun 26, 2026 · Last modified: Jul 1, 2026 · CWE-335
0.5%EPSS · 30 days0.5%
2026-09-242026-10-22
Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.
- github.comhttps://github.com/daoswald/Bytes-Random-Secure-Tiny/issues/6
- github.comhttps://github.com/daoswald/Bytes-Random-Secure-Tiny/pull/7
- security.metacpan.orghttps://security.metacpan.org/patches/B/Bytes-Random-Secure-Tiny/1.011/CVE-2026-11702-r1.patch
- www.cve.orghttps://www.cve.org/CVERecord?id=CVE-2026-11625
- www.cve.orghttps://www.cve.org/CVERecord?id=CVE-2026-41564
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-117305.4 MED7.7%
——2Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.4dCVE-2026-116257.5 HIG42.5%
——13Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.
When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.
Secrets generated in multiprocess applications are predictable across processes.114dCVE-2025-525785.7 MED4.4%
——1Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications.
This issue affects Command Centre Server:
9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.5dCVE-2018-146477.5 HIG95.9%
——29Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.16d