CVE-2026-13082
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Jul 17, 2026
CISA due date
—
The record
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string. The built-in rand function is unsuitable for security applications because it is predictable and reversible.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121553 Cotonti through 1.0.0 generates registration and email-change validation tokens with… CWE-338
- CVE-2026-118986 CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing… CWE-338
- CVE-2026-102813 An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. CWE-338
- CVE-2026-74887 openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne… CWE-338
- CVE-2026-73567 sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms… CWE-338
- CVE-2026-71851 crypto-js is a JavaScript library of crypto standards. CWE-338
- CVE-2026-9205 IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the… CWE-338
- CVE-2026-47882 When enabling Spring Boot DevTools support for a remote application target (for example a… CWE-338