Skip to content
OpenAdvisories

Weakness (CWE)

CWE-331: Insufficient Entropy

Base Draft

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

How to prevent it (1 mitigation)

  1. Implementation

    Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.

Source: MITRE CWE-331

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.8
    CVE-2026-92209 Public exploit

    NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability

    NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code…

    NoMachine NoMachine
  • Critical 9.0
    CVE-2026-71851 Public exploit

    crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

    crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), in…

    brix crypto-js cryptojs crypto-js Debian Ubuntu npm
  • Medium 6.8
    CVE-2026-1814 Public exploit

    Rapid7 Nexpose Insecure Java Keystore Password Generation

    Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy keystore passwords, the application generates a new password with insufficient le…

    Rapid7 InsightVM/Nexpose
  • Critical 9.5
    CVE-2025-52464 Public exploit

    Meshtastic Repeated Public and Private Keypairs

    Meshtastic is an open source mesh networking solution. In versions from 2.5.0 to before 2.6.11, the flashing procedure of several hardware vendors was resulting in duplicated public/private keys. Additionally, the Meshtastic was failing to properly initialize…

    meshtastic firmware
  • High 7.5
    CVE-2024-53522 Public exploit

    Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe…

  • High 7.5
    CVE-2018-18326 Public exploit EPSS 54%

    Insufficient Entropy in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.

    DotNetNuke.Core NuGet
  • High 7.5
    CVE-2018-15812 Public exploit EPSS 47%

    Insufficient Entropy in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.

    DotNetNuke.Core NuGet