https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 10 Aug 2026 02:36:03 +0000 https://vulnerability.circl.lu/sighting/ec632e76-0c19-4daf-bc5e-af461b4901c3/export {"uuid": "ec632e76-0c19-4daf-bc5e-af461b4901c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-71851", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mskaecwoh72v", "content": "brix crypto-js CRITICAL flaw (CVE-2026-71851): Insufficient entropy in WordArray.random() exposes wallets to private key theft. Affected: 3.1.2-4 to <4.0.0. Upgrade to 4.0.0+ ASAP. https://radar.offseq.com/threat/cve-2026-71851-cwe-331-insufficient-entropy-in-brix-crypto-js-e5283f6c465bd95e #OffS...", "creation_timestamp": "2026-08-08T04:30:27.672500Z"} {"uuid": "ec632e76-0c19-4daf-bc5e-af461b4901c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-71851", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mskaecwoh72v", "content": "brix crypto-js CRITICAL flaw (CVE-2026-71851): Insufficient entropy in WordArray.random() exposes wallets to private key theft. Affected: 3.1.2-4 to <4.0.0. Upgrade to 4.0.0+ ASAP. https://radar.offseq.com/threat/cve-2026-71851-cwe-331-insufficient-entropy-in-brix-crypto-js-e5283f6c465bd95e #OffS...", "creation_timestamp": "2026-08-08T04:30:27.672500Z"} https://vulnerability.circl.lu/sighting/ec632e76-0c19-4daf-bc5e-af461b4901c3/export Sat, 08 Aug 2026 04:30:27 +0000 https://vulnerability.circl.lu/sighting/5471ff3e-3c46-42ac-987d-4672371bf477/export {"uuid": "5471ff3e-3c46-42ac-987d-4672371bf477", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-71851", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117058006236524756", "content": "CVE-2026-71851 (CRITICAL, CVSS 9): brix crypto-js <4.0.0 uses weak RNG in WordArray.random(), risking private key recovery in wallet apps using BIP39. Upgrade to 4.0.0+ now. https://radar.offseq.com/threat/cve-2026-71851-cwe-331-insufficient-entropy-in-brix-crypto-js-e5283f6c465bd95e #OffSeq #CryptoJS #InfoSec #Vulnerability", "creation_timestamp": "2026-08-08T04:30:25.909750Z"} {"uuid": "5471ff3e-3c46-42ac-987d-4672371bf477", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-71851", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117058006236524756", "content": "CVE-2026-71851 (CRITICAL, CVSS 9): brix crypto-js <4.0.0 uses weak RNG in WordArray.random(), risking private key recovery in wallet apps using BIP39. Upgrade to 4.0.0+ now. https://radar.offseq.com/threat/cve-2026-71851-cwe-331-insufficient-entropy-in-brix-crypto-js-e5283f6c465bd95e #OffSeq #CryptoJS #InfoSec #Vulnerability", "creation_timestamp": "2026-08-08T04:30:25.909750Z"} https://vulnerability.circl.lu/sighting/5471ff3e-3c46-42ac-987d-4672371bf477/export Sat, 08 Aug 2026 04:30:25 +0000 https://vulnerability.circl.lu/sighting/6be479dc-b607-4296-a99e-f3b806cfd0e3/export {"uuid": "6be479dc-b607-4296-a99e-f3b806cfd0e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msk3dxl5gn23", "content": "\ud83d\udd34 CVE-2026-71851 - Critical (9)\n\ncrypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 gener...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-71851/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-08T03:00:47.380865Z"} {"uuid": "6be479dc-b607-4296-a99e-f3b806cfd0e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msk3dxl5gn23", "content": "\ud83d\udd34 CVE-2026-71851 - Critical (9)\n\ncrypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 gener...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-71851/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-08T03:00:47.380865Z"} https://vulnerability.circl.lu/sighting/6be479dc-b607-4296-a99e-f3b806cfd0e3/export Sat, 08 Aug 2026 03:00:47 +0000 https://vulnerability.circl.lu/sighting/55d775ed-892a-4dc9-b302-903a890ab84f/export {"uuid": "55d775ed-892a-4dc9-b302-903a890ab84f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://gist.github.com/alon710/fa679955da8f3503916dff57f8688b8c", "content": "# CVE-2026-71851: CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom)\n\n> **CVSS Score:** 9.0\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71851\n\n## Summary\nA severe, twelve-year-old cryptographic weakness in crypto-js (versions < 4.0.0) generated pseudorandom numbers using a custom Multiply-With-Carry (MWC) algorithm seeded from the non-secure Math.random(). This reduces 128-bit and 256-bit key spaces to just 2^39 and 2^47 possibilities, allowing offline brute-force attacks.\n\n## TL;DR\nLegacy versions of crypto-js generate weak keys using Math.random() in a custom MWC generator, enabling attackers to systematically brute-force and drain cryptocurrency wallets.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-338\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.0 (Critical)\n- **Exploit Status**: Active In-The-Wild\n- **Primary Impact**: Private Key Compromise and Asset Theft\n- **Component**: CryptoJS.lib.WordArray.random()\n\n## Affected Systems\n\n- crypto-js <= 3.3.0\n- Legacy web3 wallets\n- Decentralized browser extensions using crypto-js 3.x\n- Hybrid mobile applications bundling legacy crypto-js dependencies\n- **crypto-js**: >= 3.1.2-4, < 4.0.0 (Fixed in: `4.0.0`)\n\n## Mitigation\n\n- Upgrade crypto-js dependency to version 4.0.0 or higher.\n- Implement platform-native secure random generation APIs.\n- Rotate all cryptographic keys and seed phrases generated under vulnerable versions.\n\n**Remediation Steps:**\n1. Verify installed dependencies using npm ls crypto-js.\n2. Upgrade packages to version 4.0.0 or later.\n3. Generate new mnemonic phrases and migrate wallet assets to fresh addresses.\n\n## References\n\n- [Ill Bloom Dedicated Research & Address Checker](https://illbloom.org/)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71851) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T21:31:50.457897Z"} {"uuid": "55d775ed-892a-4dc9-b302-903a890ab84f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://gist.github.com/alon710/fa679955da8f3503916dff57f8688b8c", "content": "# CVE-2026-71851: CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom)\n\n> **CVSS Score:** 9.0\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71851\n\n## Summary\nA severe, twelve-year-old cryptographic weakness in crypto-js (versions < 4.0.0) generated pseudorandom numbers using a custom Multiply-With-Carry (MWC) algorithm seeded from the non-secure Math.random(). This reduces 128-bit and 256-bit key spaces to just 2^39 and 2^47 possibilities, allowing offline brute-force attacks.\n\n## TL;DR\nLegacy versions of crypto-js generate weak keys using Math.random() in a custom MWC generator, enabling attackers to systematically brute-force and drain cryptocurrency wallets.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-338\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.0 (Critical)\n- **Exploit Status**: Active In-The-Wild\n- **Primary Impact**: Private Key Compromise and Asset Theft\n- **Component**: CryptoJS.lib.WordArray.random()\n\n## Affected Systems\n\n- crypto-js <= 3.3.0\n- Legacy web3 wallets\n- Decentralized browser extensions using crypto-js 3.x\n- Hybrid mobile applications bundling legacy crypto-js dependencies\n- **crypto-js**: >= 3.1.2-4, < 4.0.0 (Fixed in: `4.0.0`)\n\n## Mitigation\n\n- Upgrade crypto-js dependency to version 4.0.0 or higher.\n- Implement platform-native secure random generation APIs.\n- Rotate all cryptographic keys and seed phrases generated under vulnerable versions.\n\n**Remediation Steps:**\n1. Verify installed dependencies using npm ls crypto-js.\n2. Upgrade packages to version 4.0.0 or later.\n3. Generate new mnemonic phrases and migrate wallet assets to fresh addresses.\n\n## References\n\n- [Ill Bloom Dedicated Research & Address Checker](https://illbloom.org/)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71851) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T21:31:50.457897Z"} https://vulnerability.circl.lu/sighting/55d775ed-892a-4dc9-b302-903a890ab84f/export Fri, 07 Aug 2026 21:31:50 +0000 https://vulnerability.circl.lu/sighting/2ef31926-0304-4727-be9a-cb04eb3cc024/export {"uuid": "2ef31926-0304-4727-be9a-cb04eb3cc024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71851", "type": "published-proof-of-concept", "source": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9", "content": "", "creation_timestamp": "2026-08-07T20:35:06.834983Z"} {"uuid": "2ef31926-0304-4727-be9a-cb04eb3cc024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71851", "type": "published-proof-of-concept", "source": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9", "content": "", "creation_timestamp": "2026-08-07T20:35:06.834983Z"} https://vulnerability.circl.lu/sighting/2ef31926-0304-4727-be9a-cb04eb3cc024/export Fri, 07 Aug 2026 20:35:06 +0000 https://vulnerability.circl.lu/sighting/124f6059-724b-4421-8b22-bd9d807ba0b5/export {"uuid": "124f6059-724b-4421-8b22-bd9d807ba0b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hmgetop3cozq3", "content": "CVE-2026-71851 - crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain\nCVE ID : CVE-2026-71851\n \n Published : Aug. 7, 2026, 7:18 p.m. | 36\u00a0minutes ago\n \n Description : crypto-js is a JavaScript library of crypto standards. ...", "creation_timestamp": "2026-08-07T20:04:08.022943Z"} {"uuid": "124f6059-724b-4421-8b22-bd9d807ba0b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hmgetop3cozq3", "content": "CVE-2026-71851 - crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain\nCVE ID : CVE-2026-71851\n \n Published : Aug. 7, 2026, 7:18 p.m. | 36\u00a0minutes ago\n \n Description : crypto-js is a JavaScript library of crypto standards. ...", "creation_timestamp": "2026-08-07T20:04:08.022943Z"} https://vulnerability.circl.lu/sighting/124f6059-724b-4421-8b22-bd9d807ba0b5/export Fri, 07 Aug 2026 20:04:08 +0000 https://vulnerability.circl.lu/sighting/c72e6808-916c-46fe-a19e-65e39516bf29/export {"uuid": "c72e6808-916c-46fe-a19e-65e39516bf29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msjb5v4unw26", "content": "CVE-2026-71851 - crypto-js\nAn outdated version of CryptoJS used in wallet applications can generate weak random numbers for BIP39 recovery phrases, potentially allowing attackers to guess them. This issue\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cryptojs #npm #CVE #infosec", "creation_timestamp": "2026-08-07T19:12:05.646091Z"} {"uuid": "c72e6808-916c-46fe-a19e-65e39516bf29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msjb5v4unw26", "content": "CVE-2026-71851 - crypto-js\nAn outdated version of CryptoJS used in wallet applications can generate weak random numbers for BIP39 recovery phrases, potentially allowing attackers to guess them. This issue\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cryptojs #npm #CVE #infosec", "creation_timestamp": "2026-08-07T19:12:05.646091Z"} https://vulnerability.circl.lu/sighting/c72e6808-916c-46fe-a19e-65e39516bf29/export Fri, 07 Aug 2026 19:12:05 +0000