Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check...
CVE-2026-82449
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrep
#cwe-208
共收录 121 条相关情报。
← 返回所有主题Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure re...
CVE-2026-82449
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrep
Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing
CVE-2026-82449
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrep
free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/u...
CVE-2026-55785
free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptograph
free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA
CVE-2026-55785
### Summary The AUSF component of free5GC compares authentication response values with normal Go equality helpers inste
A blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed...
CVE-2026-78500
A blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.e...
CVE-2026-59276
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals())
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attac...
CVE-2026-80199
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers t
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force....
CVE-2026-18259
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token
Kimai before 2.54.0 Username Enumeration via Timing Oracle
CVE-2026-80199
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers t
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.
CVE-2026-18259
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token
Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string comparison with the === operator instead of hash_equals() for C...
CVE-2026-72701
Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string compar
The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation tokens using a non-constant-time === string comparison i...
CVE-2026-72700
The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation
WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison fun...
CVE-2026-53525
CVE-2026-53525是WeeChat客户端中relay认证功能的一个时序侧信道漏洞。WeeChat是一款开源聊天客户端，支持多种协议，其relay功能允许通过远程接口进行操作。在受影响的版本（0.3.1至4.9.0）中，relay模
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in fram...
CVE-2026-44255
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 an
Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the sig...
CVE-2026-75589
Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time
Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling
Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes: - **Weak RNG for tokens (CWE-330):** author/sessio
Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts ...
CVE-2026-16459
Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and
Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing...
CVE-2026-16458
Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to
Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagne...
CVE-2026-43606
Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local acce