By weakness (CWE)

CWE-340: related vulnerabilities

CVEs classified under CWE-340. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

5 published vulnerabilities

• CVE-2026-45673MEDIUM 6.8

  Netty, a widely-used Java framework for building network applications, has a DNS resolver flaw that makes it easier for attackers to poison DNS caches. The issue stems from two weaknesses: the framework generates DNS request IDs using a predictable random number generator, and it sends all DNS queries from the same UDP port by default. Together, these reduce the unpredictability of DNS traffic, making it feasible for an attacker to craft malicious DNS responses that get cached and served to users—a technique known as DNS Cache Poisoning or a Kaminsky attack. Patched versions 4.1.135.Final and 4.2.15.Final address both issues.

• CVE-2026-9219MEDIUM 6.5

  Setracker2, an Android companion app for smartwatch management, contains a flaw in how it registers new devices. The app generates a unique registration ID based on the phone's IMEI number in a predictable way, and the enrollment system doesn't verify that the person requesting enrollment actually owns the watch being registered. An attacker who learns or guesses a registration ID could hijack someone else's smartwatch, taking control of it within the app and potentially accessing associated data or features.

• CVE-2026-56016MEDIUM 5.9

  CGI::Session::ID::md5 versions before 4.49 contain a critical flaw in how session identifiers are generated. Instead of using cryptographically secure random sources, the library constructs session IDs from three predictable inputs: the process ID, the current time, and Perl's built-in rand() function. An attacker who understands this algorithm can predict valid session IDs and hijack user sessions without knowing credentials, effectively bypassing authentication entirely.

• CVE-2026-42932MEDIUM 5.3

  Naxclow devices use predictable device identifiers that are generated using fixed manufacturing prefixes and simple sequential counters. This design flaw allows an attacker to easily predict or enumerate which devices exist on a network without authentication. Additionally, the platform exposes a publicly accessible endpoint that reveals the highest device identifier currently in use, making it trivial to determine the size and composition of an active Naxclow fleet.

• CVE-2026-9692MEDIUM 5.3

  Mojolicious::Sessions::Storable, a Perl session management module, uses a weak method to generate session identifiers through version 0.05. The session IDs are created by hashing together predictable data sources: the system's built-in random number generator (which is not cryptographically secure), the current timestamp, the memory address of a temporary data structure, and the process ID. An attacker with knowledge of these values or patterns could predict or forge valid session IDs, potentially gaining unauthorized access to user sessions without needing the correct credentials.