randombit has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 5. The median CVSS is 6.1 (medium), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.1
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-118769Critical· 9.2Botan: Integer overflow when reporting block size in FFI can cause memory corruption51CVE-2026-118765High· 7.3Botan: AutoSeeded_RNG can become reinitialized from predictable data after clearing state40CVE-2026-118766Medium· 6.1Botan: Online OCSP redirects enable blind requests to internal HTTP services34CVE-2026-118768Medium· 5.9Botan: CLI utility `ocsp_check` accepts unauthenticated responses32CVE-2026-118767Medium· 4.8Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs26
randombit vulnerabilities
CVEs affecting randombit, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-118767Medium· 4.8Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs
Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently rejecting the embedded NUL, causing bcrypt and check_bcrypt to p…
CVE-2026-118769Critical· 9.2Botan: Integer overflow when reporting block size in FFI can cause memory corruption
Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter…
CVE-2026-118765High· 7.3Botan: AutoSeeded_RNG can become reinitialized from predictable data after clearing state
Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then calls randomize with an empty output buffer while the generator is unseeded can cause AutoSeeded_RNG to mark itself …
CVE-2026-118768Medium· 5.9Botan: CLI utility `ocsp_check` accepts unauthenticated responses
Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the sig…
CVE-2026-118766Medium· 6.1Botan: Online OCSP redirects enable blind requests to internal HTTP services
Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responde…