CVE-2026-18560 | Medium | 4.3 | 2026-10-16 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which… |
CVE-2026-110926 | Medium | 5.3 | 2026-10-15 | A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can… |
CVE-2026-110141 | Low | 3.1 | 2026-10-13 | Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-97788 | High | 7.5 | 2026-10-13 | Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-97782 | Medium | 6.8 | 2026-10-13 | Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network. |
CVE-2026-88834 | Low | 3.7 | 2026-10-13 | A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configu… |
CVE-2026-109337 | Medium | 4.3 | 2026-10-12 | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions u… |
CVE-2026-106506 | Medium | 5.3 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input v… |
CVE-2026-106351 | Medium | 5.3 | 2026-10-06 | Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-106336 | Medium | 4.3 | 2026-10-06 | Observable discrepancy in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-106303 | Medium | 5.3 | 2026-10-06 | Observable discrepancy in Autofill AI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged… |
CVE-2026-106210 | Low | 3.1 | 2026-10-06 | Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension… |
CVE-2026-106180 | Low | 3.1 | 2026-10-06 | Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTM… |
CVE-2026-105675 | High | 7.5 | 2026-10-05 | Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret toke… |
CVE-2026-105652 | Low | 3.1 | 2026-10-05 | Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' h… |
CVE-2026-11795 | Medium | 5.3 | 2026-10-02 | Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting.
This issue affects E-Commerce… |
CVE-2026-104416 | High | 7.5 | 2026-10-02 | Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staf… |
CVE-2026-104415 | Low | 3.1 | 2026-10-02 | Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative orderi… |
CVE-2026-63573 | | | 2026-10-02 | Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc. bc-csharp b… |
CVE-2026-63567 | | | 2026-10-02 | Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or… |
CVE-2026-56098 | Medium | 4.3 | 2026-10-01 | A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through i… |
CVE-2026-103275 | Medium | 4.3 | 2026-10-01 | Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters… |
CVE-2026-103272 | High | 7.5 | 2026-10-01 | Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data… |
CVE-2026-84461 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses fo… |
CVE-2026-95270 | Low | 3.7 | 2026-09-22 | A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password of the file changedetectionio/flask_app… |
CVE-2026-91725 | Medium | 5.3 | 2026-09-15 | Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromiu… |
CVE-2026-91714 | Medium | 5.3 | 2026-09-15 | Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sensitive information v… |
CVE-2026-56888 | Medium | 6.2 | 2026-09-15 | In multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalation of privilege with… |
CVE-2026-59341 | Medium | 4.2 | 2026-09-15 | A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints. By submitting a modified payload containing custom Go templa… |
CVE-2025-5802 | Medium | 5.3 | 2026-09-15 | The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts t… |
CVE-2025-13166 | Low | 3.7 | 2026-09-15 | The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses rece… |
CVE-2026-87623 | Medium | 6.5 | 2026-09-09 | Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information v… |
CVE-2026-87620 | Medium | 6.5 | 2026-09-09 | Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chrom… |
CVE-2026-87619 | Medium | 4.3 | 2026-09-09 | Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromi… |
CVE-2026-87566 | Medium | 5.3 | 2026-09-09 | Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chro… |
CVE-2026-87539 | Low | 3.1 | 2026-09-09 | Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-87518 | Medium | 5.3 | 2026-09-09 | Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-87516 | Medium | 4.3 | 2026-09-09 | Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chro… |
CVE-2026-87478 | Medium | 6.5 | 2026-09-09 | Observable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (… |
CVE-2026-87459 | Medium | 6.5 | 2026-09-09 | Observable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Ch… |
CVE-2026-53933 | | | 2026-09-08 | Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was comp… |
CVE-2026-78617 | | | 2026-08-28 | WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automate… |
CVE-2026-37064 | Medium | 5.3 | 2026-08-27 | User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via… |
CVE-2026-11754 | Medium | 5.3 | 2026-08-27 | Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting.
This issue affects syWEB: through 27082026.
NOTE: The vendor was con… |
CVE-2026-55227 | Medium | 4.3 | 2026-08-26 | Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting th… |
CVE-2026-79287 | Medium | 5.3 | 2026-08-25 | Observable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chr… |
CVE-2026-79242 | Medium | 5.3 | 2026-08-25 | Observable discrepancy in HTML in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chro… |
CVE-2026-79181 | Medium | 5.3 | 2026-08-25 | Observable discrepancy in Glic in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chro… |
CVE-2026-79030 | Medium | 5.3 | 2026-08-25 | Observable discrepancy in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (… |
CVE-2026-79028 | Medium | 5.3 | 2026-08-25 | Observable discrepancy in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (C… |
CVE-2026-79016 | Medium | 4.3 | 2026-08-25 | Observable discrepancy in SVG in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-78955 | Medium | 6.5 | 2026-08-25 | Observable discrepancy in PerformanceAPIs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origin data via a craft… |
CVE-2026-78949 | Low | 2.9 | 2026-08-25 | Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-instal… |
CVE-2026-78936 | Low | 2.9 | 2026-08-25 | Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-instal… |
CVE-2026-72699 | Medium | 5.3 | 2026-08-25 | The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a… |
CVE-2026-74961 | Critical | 9.1 | 2026-08-18 | Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74954 | High | 7.5 | 2026-08-18 | Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154… |
CVE-2026-23937 | Medium | 6.5 | 2026-08-18 | The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. |
CVE-2026-23931 | Medium | 4.3 | 2026-08-18 | The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confident… |
CVE-2026-19965 | Low | 3.7 | 2026-08-17 | A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server… |
CVE-2026-73630 | Medium | 5.8 | 2026-08-14 | SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth o… |
CVE-2026-72632 | High | 7.1 | 2026-08-13 | Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value o… |
CVE-2026-58445 | Low | 2.7 | 2026-08-13 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API |
CVE-2026-59502 | Medium | 5.3 | 2026-08-13 | : Observable Discrepancy vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions).
This issue affects Portal Generator a… |
CVE-2026-73409 | | | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and… |
CVE-2025-13736 | Low | 3.7 | 2026-08-06 | When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and… |
CVE-2026-59640 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS… |
CVE-2026-67193 | Medium | 5.3 | 2026-07-29 | Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCou… |
CVE-2026-55555 | High | 7.5 | 2026-07-28 | Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-… |
CVE-2026-64713 | High | 8.1 | 2026-07-27 | This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchO… |
CVE-2026-65314 | Medium | 4.3 | 2026-07-21 | Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by… |
CVE-2026-47011 | Low | 2.6 | 2026-07-21 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface). Supported versions that are affected are 17.0-26.4… |
CVE-2026-64822 | Medium | 5.3 | 2026-07-21 | djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unau… |
CVE-2026-56339 | High | 7.5 | 2026-07-15 | Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_in… |
CVE-2026-56296 | Medium | 5.3 | 2026-07-11 | Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that returns distinct error messages for existi… |
CVE-2026-58503 | | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password endpoint. This issu… |
CVE-2026-51926 | High | 7.5 | 2026-07-09 | An issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive information via the login.php component. A vulnerability was identif… |
CVE-2026-44332 | Medium | 5.3 | 2026-07-08 | Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/c… |
CVE-2026-56327 | Medium | 5.3 | 2026-06-30 | Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function that allows unauthenticated attackers to e… |
CVE-2026-14112 | Medium | 5.3 | 2026-06-30 | Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-14071 | Medium | 6.5 | 2026-06-30 | Side-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML pag… |
CVE-2026-47379 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared-view password check fell back to strict-equality (===) comparison for… |
CVE-2026-56316 | Medium | 5.3 | 2026-06-21 | Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to… |
CVE-2026-56319 | Medium | 4.3 | 2026-06-20 | Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distingu… |
CVE-2023-54357 | High | 7.5 | 2026-06-19 | Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploit… |
CVE-2026-11289 | Medium | 6.5 | 2026-06-05 | Side-channel information leakage in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-11284 | Medium | 6.5 | 2026-06-05 | Side-channel information leakage in PerformanceAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2026-45294 | Medium | 5.3 | 2026-05-29 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct resp… |
CVE-2026-45410 | Medium | 5.3 | 2026-05-28 | TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts vi… |
CVE-2026-8242 | Low | 3.7 | 2026-05-10 | A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. The impacted element is the function doAction of the component Login RMI Inte… |
CVE-2026-41588 | Critical | 9.0 | 2026-05-08 | RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py — check_sign_in_key(). This issue h… |
CVE-2026-44263 | Medium | 4.3 | 2026-05-07 | Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeration of translations i… |
CVE-2023-5872 | Medium | 4.3 | 2026-04-16 | In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific… |
CVE-2026-26895 | Medium | 5.3 | 2026-04-02 | User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform. |
CVE-2025-67806 | Low | 3.7 | 2026-04-01 | The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions… |
CVE-2026-33429 | Medium | 5.3 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacke… |
CVE-2026-33425 | Medium | 5.3 | 2026-03-21 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, unauthenticated users can determine whether a spe… |
CVE-2026-3580 | Medium | 4.7 | 2026-03-19 | In wolfSSL 5.8.4, constant-time masking logic in sp_256_get_entry_256_9 is optimized into conditional branches (bnez) by GCC when targeting RISC-V RV32I with -… |
CVE-2026-3579 | Medium | 5.9 | 2026-03-19 | wolfSSL 5.8.4 on RISC-V RV32I architectures lacks a constant-time software implementation for 64-bit multiplication. The compiler-inserted __muldi3 subroutine… |
CVE-2026-28490 | Medium | 6.5 | 2026-03-16 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified… |