Skip to content
OpenAdvisories

Weakness (CWE)

CWE-331: Insufficient Entropy

Base Draft

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

How to prevent it (1 mitigation)

  1. Implementation

    Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.

Source: MITRE CWE-331

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.8
    CVE-2026-92209 Public exploit

    NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability

    NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code…

    NoMachine NoMachine
  • High 7.5
    CVE-2024-53522 Public exploit

    Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe…

  • High 7.5
    CVE-2018-18326 Public exploit EPSS 54%

    Insufficient Entropy in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.

    DotNetNuke.Core NuGet
  • High 7.5
    CVE-2018-15812 Public exploit EPSS 47%

    Insufficient Entropy in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.

    DotNetNuke.Core NuGet