Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves
CVE-2026-54872
Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves
#cwe-208
共收录 121 条相关情报。
← 返回所有主题OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recove...
CVE-2026-63132
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
CVE-2026-63132
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of...
CVE-2026-77987
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. Th
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user...
CVE-2026-77987
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. Th
Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
CVE-2026-88010
## Summary Traefik's BasicAuth middleware coalesces concurrent credential checks through a `singleflight.Group` to avoi
lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function
CVE-2026-85725
### Summary When plaintext passwords are stored in AUTH_ACCOUNTS, the comparison uses Python's == operator which is not
Tinyauth: User enumeration attack by timing oracle
CVE-2026-77582
### Summary It's possible to enumerate users through a timing oracle. In other words: I can easily check if a username e
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS password values w...
CVE-2026-85725
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwo
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.go constructs the BasicAuth singleflig...
CVE-2026-88010
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewar
LightRAG: Plaintext Passwords Compared Without Constant-Time Function
CVE-2026-85725
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwo
Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
CVE-2026-88010
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewar
A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password of the file changedetectionio/flask_app.py of the componen...
CVE-2026-95270
A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password o
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
CVE-2026-72701
## Summary `Grav\Common\Utils::verifyNonce()`, the core function Grav and its plugins use to validate CSRF nonces, comp
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
CVE-2026-84308
The pure-PHP X25519 scalar multiplication in phpseclib is not constant-time. Field addition and subtraction each perform
Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Black Box Reverse Engin...
CVE-2026-16037
Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFr
Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.
CVE-2026-81159
Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commer
phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-depende...
CVE-2026-84308
phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in ph
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
CVE-2026-84308
phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in ph
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows...
CVE-2026-80199
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers t