WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distingu...

CVE-2026-54768

WPGraphQL 是 WordPress 站点的 GraphQL API 插件。在 2.0.0 至 2.15.1 版本中，SendPasswordResetEmailPayload 上的已废弃 user 字段存在逻辑缺陷，允许未认证的调用

历史摘要 · 未重新核验 · NVD

WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

CVE-2026-54768

## Summary The `sendPasswordResetEmail` mutation in WPGraphQL is explicitly designed to prevent user enumeration. The r

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Account Enumeration via Login Lockout Response Differential

## Summary The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticat

历史摘要 · 未重新核验 · GitHub Advisory

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing time...

CVE-2026-42218

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login in

历史摘要 · 未重新核验 · NVD

XRDP is vulnerable to a server timing attack, leading to user enumeration

CVE-2026-42218

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login in

历史摘要 · 未重新核验 · OSV.dev

HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in the system. Use re...

CVE-2024-23574

HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to

历史摘要 · 未重新核验 · NVD

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross...

CVE-2026-47083

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By u

历史摘要 · 未重新核验 · GitHub Advisory

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user coul...

CVE-2026-47083

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By u

历史摘要 · 未重新核验 · NVD

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches on...

CVE-2026-15747

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH

历史摘要 · 未重新核验 · NVD

SAP HANA Database (user self service tools) allows an unauthenticated user to send specially...

CVE-2026-44753

SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produ

历史摘要 · 未重新核验 · GitHub Advisory

SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of val...

CVE-2026-44753

CVE-2026-44753 影响 SAP HANA 数据库的用户自助服务工具组件。该漏洞允许未经身份验证的攻击者发送特制请求，由于服务器对不同请求返回可区分的响应，攻击者能够据此枚举有效的用户账户和电子邮件地址。该漏洞源于应用中响应差别的

历史摘要 · 未重新核验 · NVD

Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attac...

CVE-2026-61503

Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the

历史摘要 · 未重新核验 · NVD

Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences

CVE-2026-61503

Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the

历史摘要 · 未重新核验 · OSV.dev

Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection

## Impact `Webauthn\SimpleFakeCredentialGenerator` is the library-provided default implementation of the `FakeCredentia

历史摘要 · 未重新核验 · GitHub Advisory

MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid users during userna...

CVE-2026-53908

MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguis

历史摘要 · 未重新核验 · NVD

Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an unauthenticated atta...

CVE-2026-53947

Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members sign

历史摘要 · 未重新核验 · NVD

vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `root`. This is not ...

CVE-2026-54445

vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial us

历史摘要 · 未重新核验 · NVD

Vantage6: Set admin user and password from environment or configuration

### Impact Vantage6 currently provides an initial user with username `root` and password `root`. This is not ideal for t

历史摘要 · 未重新核验 · GitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct responses depending on...

CVE-2026-45294

FreeScout 是一个基于 PHP 的 Laravel 框架构建的免费帮助台和共享收件箱系统。在版本 1.8.219 之前，其密码重置端点会针对提交的邮箱地址是否属于有效用户账户返回视觉上不同的响应（例如，存在账户时返回“重置链接已发送

历史摘要 · 未重新核验 · NVD

WWBN AVideo is an open source video platform. In 29.0 and earlier, objects/mention.json.php has no User::loginCheck() or admin gate. It only has an entry guard: preg_match('/^@/...

CVE-2026-45620

WWBN AVideo is an open source video platform. In 29.0 and earlier, objects/mention.json.php has no User::loginCheck() or

历史摘要 · 未重新核验 · NVD