Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing att...

CVE-2026-48011

Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the us

历史摘要 · 未重新核验 · NVD

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially l...

CVE-2026-5419

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing si

历史摘要 · 未重新核验 · NVD

TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing ...

CVE-2026-45410

TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attac

历史摘要 · 未重新核验 · NVD

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing...

CVE-2026-5091

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions us

历史摘要 · 未重新核验 · GitHub Advisory

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing ...

CVE-2026-5091

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions us

历史摘要 · 未重新核验 · NVD

Netatalk 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, which allows a remote attacker to recover authentication credentials via timing analysis.

CVE-2026-44061

Netatalk 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, which allows a remote attacker

历史摘要 · 未重新核验 · NVD

Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These...

CVE-2026-47373

Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These versions use Perl's built-in e

历史摘要 · 未重新核验 · GitHub Advisory

Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to gu...

CVE-2026-47373

Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These versions use Perl's built-in e

历史摘要 · 未重新核验 · NVD

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.

CVE-2026-47784

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because me

历史摘要 · 未重新核验 · NVD

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_s...

CVE-2026-47783

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a

历史摘要 · 未重新核验 · NVD

PyQuorum is a cryptographic library for secret sharing and key management. Prior to 0.2.1, the mul_mod function implements multiplication via a binary expansion loop whose execu...

CVE-2026-44368

PyQuorum is a cryptographic library for secret sharing and key management. Prior to 0.2.1, the mul_mod function implemen

历史摘要 · 未重新核验 · NVD

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single v...

CVE-2026-42602

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in

历史摘要 · 未重新核验 · NVD

RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py — check_sign_in_key(). This issue has been patched vi...

CVE-2026-41588

RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth

历史摘要 · 未重新核验 · NVD

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.2.0, the /api/auth/login endpoint contains a logic fla...

CVE-2026-41161

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version

历史摘要 · 未重新核验 · NVD

mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening

## Summary `mcp-ssh-tool` has released version `2.1.1` with security hardening for transfer path authorization and HTTP

历史摘要 · 未重新核验 · GitHub Advisory

Kanidm has non-constant-time comparison of OAuth2 client_secret

### Summary The kanidmd OAuth2 token-exchange (`/oauth2/token`) and token-introspection (`/oauth2/token/introspect`) en

历史摘要 · 未重新核验 · GitHub Advisory

Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening

## Summary Eight independently-filed bug fixes in the v7.1.3 → v7.5.0 release window collectively close a set of multi-

历史摘要 · 未重新核验 · GitHub Advisory

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version ...

CVE-2026-33006

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remot

历史摘要 · 未重新核验 · NVD

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middle...

CVE-2026-41263

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing

历史摘要 · 未重新核验 · NVD

An attacker on the same network as the remote application may be able to utilize a timing attack...

CVE-2026-40972

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information

历史摘要 · 未重新核验 · GitHub Advisory