I see a lot of sites use GUIDs for password resets, unsubscribe requests and other forms of unique identification.

Presumably they are appealing because they are easy to generate, unique, non-sequential and seem random. 

But are they safe enough for these purposes?

It seems to me that given a GUID, predicting subsequent GUIDs may be possible since (as far as I know) they're not intended to be cryptographically secure...or are they?

Note: 


I'm not talking about sites that use a random blob of gobbledygook encoded in base64. 
I'm talking about sites like this that appear to be using a raw guid:
http://example.com/forgotPassword/?id=b4684ce3-ca5b-477f-8f4d-e05884a83d3c


Are they safe enough for the purposes you described?  In my opinion, generally yes.   Are they safe enough in applications where security is a significant concern?  No.   They're generated using a non-random algorithm, so they are not in any way cryptographically random or secure.
So for an unsubscribe or subscription verification function, I really don't see a security issue.  To identify a user of an online banking application on the other hand, (or really probably even a password reset function of a site where identity is valuable) GUIDs are definitely inadequate.
For more information, you might want to check out section 6 (Security Considerations) of the RFC 4122 for GUIDs (or Universally Unique Identifiers).
