CWE-330Use of Insufficiently Random Values

Abstraction: Class · CVEs in our corpus: 388

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Last updated: 22 August 2026 14:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 11 mapping(s) from 5 framework(s): STIG oracle linux 8 3 (mostly) · STIG rhel 8 3 (mostly) · CAPEC 3 (partial) · STIG oracle linux 9 1 (mostly) · STIG rhel 9 1 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A04:2025 Cryptographic Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SC-12 Cryptographic Key Establishment and Management
PR.PS-06
SC-12 Cryptographic Key Establishment and Management
SC-13 Cryptographic Protection

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

8 hardening rules · 4 OS baselines

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (1)AI-assisted

Control	Title	Family	Why it addresses this CWE
`SC-12`	Cryptographic Key Establishment and Management	SC	Key generation under controlled management uses approved random-bit sources rather than insufficiently random values.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2019-5420`	9.9	9.8	0.9214	2019-03-27
`CVE-2021-34646`	9.4	9.8	0.5087	2021-08-30
`CVE-2018-17888`	8.8	9.8	0.2964	2018-10-12
`CVE-2017-6026`	8.4	9.1	0.3182	2017-06-30
`CVE-2008-2433`	8.2	9.8	0.1093	2008-08-27
`CVE-2017-16924`	8.1	9.8	0.0860	2018-02-19
`CVE-2021-40422`	8.1	10.0	0.0581	2022-04-14
`CVE-2019-9898`	7.9	9.8	0.0394	2019-03-21
`CVE-2019-7667`	7.9	9.8	0.0450	2019-07-01
`CVE-2022-36536`	7.9	9.8	0.0404	2022-09-16
`CVE-2008-3612`	7.8	9.8	0.0352	2008-09-11
`CVE-2019-0729`	7.8	9.8	0.0313	2019-03-05
`CVE-2021-27200`	7.8	9.8	0.0336	2021-06-11
`CVE-2016-5100`	7.7	9.8	0.0192	2017-02-13
`CVE-2017-7902`	7.7	9.8	0.0256	2017-06-30
`CVE-2019-9863`	7.7	9.8	0.0215	2019-03-27
`CVE-2019-15130`	7.7	9.8	0.0240	2019-08-18
`CVE-2017-7905`	7.6	9.8	0.0128	2017-06-30
`CVE-2018-18375`	7.6	9.8	0.0130	2018-10-16
`CVE-2018-18531`	7.6	9.8	0.0147	2018-10-19
`CVE-2018-18602`	7.6	9.8	0.0143	2018-12-31
`CVE-2014-6311`	7.6	9.8	0.0167	2019-11-22
`CVE-2019-16674`	7.6	9.8	0.0187	2019-12-06
`CVE-2020-9502`	7.6	9.8	0.0149	2020-05-13
`CVE-2020-11901`	7.6	9.0	0.2112	2020-06-17