CWE-203 · Observable Discrepancy

758 CVEs classified under CWE-203 (Observable Discrepancy). Browse by severity and year.

Top CVEs for CWE-203
CVESeverityScorePublishedSummary
CVE-2019-25337Critical9.82026-02-12OwnCloud 8.1.8 contains a username enumeration vulnerability that allows remote attackers to discover user accounts by manipulating the share.php endpoint. Att…
CVE-2026-23519Critical9.82026-01-15RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches b…
CVE-2025-39702Critical9.82025-09-05In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to…
CVE-2025-27667Critical9.82025-03-05Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative User Email Enumeration OVE-20230524-001…
CVE-2024-25714Critical9.82024-02-11In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when…
CVE-2024-25191Critical9.82024-02-08php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
CVE-2024-25190Critical9.82024-02-08l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
CVE-2024-25189Critical9.82024-02-08libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
CVE-2024-23771Critical9.82024-01-22darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication vi…
CVE-2023-40756Critical9.82023-08-28User enumeration is found in PHPJabbers Callback Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacke…
CVE-2022-23304Critical9.82022-01-17The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access pattern…
CVE-2022-23303Critical9.82022-01-17The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. N…
CVE-2019-10071Critical9.82019-09-16The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC sign…
CVE-2018-1000884Critical9.82018-12-20Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information Exposure Through Ti…
CVE-2024-47678Critical9.42024-10-21In the Linux kernel, the following vulnerability has been resolved: icmp: change the order of rate limits ICMP messages are ratelimited : After the blamed c…
CVE-2025-10890Critical9.12025-09-24Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C…
CVE-2023-26556Critical9.12023-04-21io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypt…
CVE-2022-40895Critical9.12022-10-06In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity…
CVE-2026-41588Critical9.02026-05-08RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py — check_sign_in_key(). This issue h…
CVE-2021-1924Critical9.02021-11-12Information disclosure through timing and power side-channels during mod exponentiation for RSA-CRT in Snapdragon Auto, Snapdragon Compute, Snapdragon Connecti…
All CVEs classified under CWE-203 — newest first (page 1 of 8)
CVESeverityScorePublishedSummary
CVE-2026-73630Medium5.82026-08-14SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth o…
CVE-2026-72632High7.12026-08-13Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value o…
CVE-2026-58445Low2.72026-08-13Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
CVE-2026-59502Medium5.32026-08-13CWE-203: Observable Discrepancy
CVE-2026-734092026-08-12Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and…
CVE-2025-13736Low3.72026-08-06When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and…
CVE-2026-596402026-08-03In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS…
CVE-2026-67193Medium5.32026-07-29Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCou…
CVE-2026-55555High7.52026-07-28Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-…
CVE-2026-64713High8.12026-07-27This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchO…
CVE-2026-65314Medium4.32026-07-21Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by…
CVE-2026-47011Low2.62026-07-21Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface). Supported versions that are affected are 17.0-26.4…
CVE-2026-64822Medium5.32026-07-21djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unau…
CVE-2026-56339High7.52026-07-15Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_in…
CVE-2026-56296Medium5.32026-07-11Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that returns distinct error messages for existi…
CVE-2026-585032026-07-10Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password endpoint. This issu…
CVE-2026-51926High7.52026-07-09An issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive information via the login.php component. A vulnerability was identif…
CVE-2026-44332Medium5.32026-07-08Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/c…
CVE-2026-56327Medium5.32026-06-30Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function that allows unauthenticated attackers to e…
CVE-2026-14112Medium5.32026-06-30Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gest…
CVE-2026-14071Medium6.52026-06-30Side-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML pag…
CVE-2026-473792026-06-23NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared-view password check fell back to strict-equality (===) comparison for…
CVE-2026-56316Medium5.32026-06-21Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to…
CVE-2026-56319Medium4.32026-06-20Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distingu…
CVE-2023-54357High7.52026-06-19Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploit…
CVE-2026-11289Medium6.52026-06-05Side-channel information leakage in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page…
CVE-2026-11284Medium6.52026-06-05Side-channel information leakage in PerformanceAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted H…
CVE-2026-45294Medium5.32026-05-29FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct resp…
CVE-2026-45410Medium5.32026-05-28TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts vi…
CVE-2026-8242Low3.72026-05-10A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. The impacted element is the function doAction of the component Login RMI Inte…
CVE-2026-41588Critical9.02026-05-08RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py — check_sign_in_key(). This issue h…
CVE-2026-44263Medium4.32026-05-07Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeration of translations i…
CVE-2023-5872Medium4.32026-04-16In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific…
CVE-2026-26895Medium5.32026-04-02User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.
CVE-2025-67806Low3.72026-04-01The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions…
CVE-2026-33429Medium5.32026-03-24Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacke…
CVE-2026-33425Medium5.32026-03-21Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, unauthenticated users can determine whether a spe…
CVE-2026-3580Medium4.72026-03-19In wolfSSL 5.8.4, constant-time masking logic in sp_256_get_entry_256_9 is optimized into conditional branches (bnez) by GCC when targeting RISC-V RV32I with -…
CVE-2026-3579Medium5.92026-03-19wolfSSL 5.8.4 on RISC-V RV32I architectures lacks a constant-time software implementation for 64-bit multiplication. The compiler-inserted __muldi3 subroutine…
CVE-2026-28490Medium6.52026-03-16Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified…
CVE-2026-21386Medium4.32026-03-16Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command which allows…
CVE-2026-4045Low3.72026-03-12A flaw has been found in projectsend up to r1945. This impacts an unknown function of the file includes/Classes/Auth.php. Executing a manipulation of the argum…
CVE-2026-4040Low3.32026-03-12A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The ma…
CVE-2026-26315High7.52026-02-19go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography imple…
CVE-2026-23621Medium4.32026-02-19GFI MailEssentials AI versions prior to 22.4 contain an arbitrary directory existence enumeration vulnerability in the ListServer.IsPathExist() web method expo…
CVE-2026-23620Medium4.32026-02-19GFI MailEssentials AI versions prior to 22.4 contain an arbitrary file existence enumeration vulnerability in the ListServer.IsDBExist() web method exposed at…
CVE-2019-25337Critical9.82026-02-12OwnCloud 8.1.8 contains a username enumeration vulnerability that allows remote attackers to discover user accounts by manipulating the share.php endpoint. Att…
CVE-2026-26185Medium5.32026-02-12Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the pa…
CVE-2026-25562Medium4.32026-02-07WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be returned without proper…
CVE-2026-25509Medium5.32026-02-03CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version…
CVE-2026-23849Medium5.32026-01-19File Browser provides a file managing interface within a specified directory and can be used to upload, delete, preview, rename, and edit files. Prior to versi…
CVE-2026-23519Critical9.82026-01-15RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches b…
CVE-2026-21484Medium5.32026-01-03AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea…
CVE-2024-55374Medium5.32026-01-02REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.
CVE-2022-50800High7.52025-12-30H3C SSL VPN contains a user enumeration vulnerability that allows attackers to identify valid usernames through the 'txtUsrName' POST parameter. Attackers can…
CVE-2023-53943Medium5.32025-12-18GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses. Attackers c…
CVE-2025-65185Low2.82025-12-17There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and…
CVE-2025-68164Low2.72025-12-16In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
CVE-2025-139122025-12-11Multiple constant-time implementations in wolfSSL before version 5.8.4 may be transformed into non-constant-time binary by LLVM optimizations, which can potent…
CVE-2020-36888Medium5.32025-12-10SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts…
CVE-2025-63094High7.52025-12-10XiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and indirect branch prediction, allowing attackers to access sensitiv…
CVE-2025-39665Medium5.32025-12-03User enumeration in Nagvis' Checkmk MultisiteAuth before version 1.9.48 allows an unauthenticated attacker to enumerate Checkmk usernames.
CVE-2025-59702High7.22025-12-02Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with elevated privileges to falsify ta…
CVE-2025-56423Medium5.32025-11-24An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensitive information via…
CVE-2025-12888High7.52025-11-21Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limit…
CVE-2025-11932Medium4.32025-11-21The server previously verified the TLS 1.3 PSK binder using a non-constant time method which could potentially leak information about the PSK binder
CVE-2025-64749Medium4.32025-11-13Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API…
CVE-2025-59716Medium5.32025-11-05ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validatio…
CVE-2025-11145High7.52025-10-24Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerabi…
CVE-2025-36225Medium4.32025-10-09IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of retu…
CVE-2025-11443Low3.72025-10-08A weakness has been identified in JhumanJ OpnForm up to 1.9.3. This affects an unknown function of the file /api/password/email of the component Forgotten Pass…
CVE-2025-54477Medium5.32025-09-30Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.
CVE-2025-41252High7.52025-09-29Description: VMware NSX contains a username enumeration vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potent…
CVE-2025-1396Low3.72025-09-26A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distin…
CVE-2025-10890Critical9.12025-09-24Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C…
CVE-2025-9031Medium4.32025-09-24Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing. This issue affects D…
CVE-2025-43786Medium5.32025-09-09Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024…
CVE-2025-39702Critical9.82025-09-05In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to…
CVE-2025-48561Medium5.52025-09-04In multiple locations, there is a possible way to access data displayed on the screen due to side channel information disclosure. This could lead to local info…
CVE-2025-57770Medium5.32025-08-22The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Versions 4.0.0 to 4.0.2, 3.0.0 to 3.3.6…
CVE-2025-43751Medium5.32025-08-22User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0…
CVE-2025-43743Medium4.32025-08-19Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu…
CVE-2025-43739Medium4.32025-08-19Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu…
CVE-2025-9109Low3.72025-08-18A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. Affected by this vulnerability is an unknown functionality of the file /password/email…
CVE-2025-8774Low2.52025-08-09A vulnerability has been found in riscv-boom SonicBOOM up to 2.2.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of…
CVE-2025-54999Low3.72025-08-09OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 thro…
CVE-2025-47872Medium5.82025-08-08The public-facing product registration endpoint server responds differently depending on whether the S/N is valid and unregistered, valid but already registe…
CVE-2025-6011Low3.72025-08-01A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users…
CVE-2025-24391Medium5.32025-07-14A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and…
CVE-2023-38327Medium5.32025-07-11An issue was discovered in eGroupWare 17.1.20190111. A User Enumeration vulnerability exists under calendar/freebusy.php, which allows unauthenticated remote a…
CVE-2025-6386High7.52025-07-07The parisneo/lollms repository is affected by a timing attack vulnerability in the `authenticate_user` function within the `lollms_authentication.py` file. Thi…
CVE-2025-60562025-07-04Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attackers to enumerate use…
CVE-2025-27451Medium5.32025-07-03For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existin…
CVE-2025-40732High7.52025-06-30user enumeration vulnerability in Daily Expense Manager v1.0. To exploit this vulnerability a POST request must be sent using the name parameter in /check.php
CVE-2025-52576Medium5.32025-06-25Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP…
CVE-2025-46570Low2.62025-05-29vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanis…
CVE-2024-47057Medium5.32025-05-28SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by…
CVE-2025-46804Low3.32025-05-26A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not…
CVE-2025-23182Medium4.32025-05-22CWE-203: Observable Discrepancy
CVE-2025-3939Medium5.32025-05-22Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX a…