CVE-2026-13199
EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent ke
CVSS
4.0
Medio
EPSS
0.1%
p2
KEV
—
Exploit Today
1
0-100
Publicado: 7 jul 2026 · Última mod.: 7 jul 2026 · CWE-331
0.1%EPSS · 30 días0.1%
2026-07-072026-07-16
EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additionally, the low-quality RNG seed may affect the quality of random numbers or delay booting while sufficient entropy is accumulated from other sources.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2024-535227.5 ALT50.3%
——15Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components. This allows attackers to access sensitive information.12dCVE-2026-410802.9 BAJ32.1%
——10libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.3dCVE-2026-11403—27.2%
——8A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.1dCVE-2023-378228.2 ALT13.2%
——4The Eufy Homebase 2 before firmware version 3.3.4.1h creates a dedicated wireless network for its ecosystem, which serves as a proxy to the end user's primary network. The WPA2-PSK generation of this dedicated network is flawed and solely based on the serial number. Due to the flawed generation process, the WPA2-PSK can be brute forced offline within seconds. This vulnerability allows an attacker in proximity to the dedicated wireless network to gain unauthorized access to the end user's primary network. The only requirement of the attack is proximity to the dedicated wireless network.12d