CVE-2026-84717 | Medium | 5.3 | 2026-09-23 | A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated
Bitbucket Data Center webhook receiver skips HMAC signature veri… |
CVE-2026-71462 | Medium | 4.1 | 2026-09-23 | StringListPathField.to_internal_value() calls
os.path.exists() on unbounded user-supplied paths.
200 vs 400 response reveals existe… |
CVE-2026-71458 | Medium | 5.0 | 2026-09-23 | URLModificationMiddleware resolves named-URL lookups
against unfiltered Model.objects before RBAC. The 403→404
shim only rewrites 4… |
CVE-2026-89173 | Medium | 5.3 | 2026-09-11 | Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enu… |
CVE-2026-9161 | Medium | 5.3 | 2026-09-10 | Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting.
This issue affects Website Template: through 1009202… |
CVE-2026-86758 | Medium | 6.5 | 2026-09-09 | Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only l… |
CVE-2026-19205 | High | 7.5 | 2026-09-04 | Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting.
This issue affects GastroMenum Web Panel: befo… |
CVE-2026-19080 | High | 7.5 | 2026-09-04 | Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting.
This issue affects Menulux Portal: before 2… |
CVE-2026-78584 | Medium | 4.3 | 2026-09-02 | Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An auth… |
CVE-2026-84307 | Low | 3.7 | 2026-09-01 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login… |
CVE-2026-81033 | Medium | 5.3 | 2026-08-26 | Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/in… |
CVE-2026-75575 | Medium | 5.3 | 2026-08-25 | Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The me… |
CVE-2026-27462 | High | 7.5 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple fact… |
CVE-2026-69519 | High | 8.6 | 2026-08-20 | Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network. |
CVE-2026-66002 | | | 2026-08-20 | Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frap… |
CVE-2026-54739 | | | 2026-08-19 | Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/local_user/login.rs ret… |
CVE-2026-19965 | Low | 3.7 | 2026-08-17 | A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server… |
CVE-2026-14672 | Medium | 5.3 | 2026-08-13 | Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM itera… |
CVE-2026-73306 | Medium | 5.3 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/ap… |
CVE-2026-72588 | Medium | 5.3 | 2026-08-10 | A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address… |
CVE-2026-55998 | Medium | 5.3 | 2026-08-05 | The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that ha… |
CVE-2026-60007 | High | 7.4 | 2026-08-04 | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentica… |
CVE-2026-14202 | Medium | 5.3 | 2026-08-04 | Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting.
… |
CVE-2026-54768 | | | 2026-07-31 | WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticat… |
CVE-2026-42218 | Medium | 5.3 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in respon… |
CVE-2024-23574 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in… |
CVE-2026-47083 | Medium | 4.3 | 2026-07-16 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authentica… |
CVE-2026-15747 | Critical | 9.1 | 2026-07-14 | Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.
_csrf_token gener… |
CVE-2026-44753 | Low | 3.7 | 2026-07-14 | SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling… |
CVE-2026-61503 | Medium | 5.3 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote una… |
CVE-2026-53422 | Medium | 4.3 | 2026-07-02 | Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and di… |
CVE-2026-53908 | Medium | 4.3 | 2026-07-01 | MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid u… |
CVE-2026-53947 | Medium | 5.3 | 2026-06-24 | Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an un… |
CVE-2026-54445 | | | 2026-06-17 | vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `r… |
CVE-2026-43926 | | | 2026-06-04 | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint `/client/reset-passwo… |
CVE-2026-45294 | Medium | 5.3 | 2026-05-29 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct resp… |
CVE-2026-45620 | Medium | 5.3 | 2026-05-29 | WWBN AVideo is an open source video platform. In 29.0 and earlier, objects/mention.json.php has no User::loginCheck() or admin gate. It only has an entry guard… |
CVE-2018-25350 | Critical | 9.8 | 2026-05-23 | userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to th… |
CVE-2026-44306 | Medium | 5.3 | 2026-05-12 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether… |
CVE-2024-0391 | Medium | 5.3 | 2026-05-11 | The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered us… |
CVE-2026-8242 | Low | 3.7 | 2026-05-10 | A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. The impacted element is the function doAction of the component Login RMI Inte… |
CVE-2026-20195 | Medium | 5.3 | 2026-05-06 | A vulnerability in an identity management API endpoint of Cisco ISE could allow an unauthenticated, remote attacker to enumerate valid user accounts on an affe… |
CVE-2026-34319 | Medium | 5.0 | 2026-04-21 | Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 a… |
CVE-2026-24468 | Medium | 5.3 | 2026-04-20 | OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11… |
CVE-2026-40485 | Medium | 5.3 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishabl… |
CVE-2026-34264 | Medium | 6.5 | 2026-04-14 | During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low… |
CVE-2026-4113 | High | 7.2 | 2026-04-09 | An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials. |
CVE-2026-39851 | Medium | 4.3 | 2026-04-08 | Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the requestEmailChange() mutation was revealing the existence… |
CVE-2025-67807 | Medium | 4.7 | 2026-04-01 | The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions… |
CVE-2025-67806 | Low | 3.7 | 2026-04-01 | The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions… |
CVE-2025-3716 | | | 2026-03-30 | User enumeration in ESET Protect (on-prem) via Response Timing. |
CVE-2026-33419 | High | 7.5 | 2026-03-24 | MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentit… |
CVE-2026-33323 | Medium | 5.3 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages… |
CVE-2026-33688 | Medium | 5.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at `objects/userRecoverPass.php` performs us… |
CVE-2026-30876 | Medium | 5.3 | 2026-03-16 | Chamilo LMS is a learning management system. Prior to version 1.11.36, Chamilo is vulnerable to user enumeration with valid/invalid username. This issue has be… |
CVE-2025-69243 | Medium | 5.3 | 2026-03-16 | Raytha CMS is vulnerable to User Enumeration in password reset functionality. Difference in messages could allow an attacker to determine if the login is valid… |
CVE-2025-13460 | Medium | 5.3 | 2026-03-16 | IBM Aspera Console 3.3.0 through 3.4.8 could allow an attacker to enumerate usernames due to an observable response discrepancy. |
CVE-2026-2859 | Medium | 4.3 | 2026-03-13 | Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated users to enumerate exi… |
CVE-2026-24097 | Medium | 4.3 | 2026-03-13 | Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows authenticated users to enumerate exist… |
CVE-2025-12455 | High | 7.5 | 2026-03-13 | Observable response discrepancy vulnerability in OpenText™ Vertica allows Password Brute Forcing.
The vulnerability could lead to Password Brute Forcing in V… |
CVE-2026-4045 | Low | 3.7 | 2026-03-12 | A flaw has been found in projectsend up to r1945. This impacts an unknown function of the file includes/Classes/Auth.php. Executing a manipulation of the argum… |
CVE-2026-31901 | Medium | 5.3 | 2026-03-11 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34 and 9.6.0-alpha.8, the email verificati… |
CVE-2026-31888 | Medium | 5.3 | 2026-03-11 | Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, the Store API login endpoint (POST /store-api/account/login) returns different error cod… |
CVE-2026-28358 | Medium | 5.3 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered a… |
CVE-2026-28288 | Medium | 5.3 | 2026-02-27 | Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an atta… |
CVE-2026-25138 | Medium | 5.3 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior t… |
CVE-2025-62512 | Medium | 5.3 | 2026-02-24 | Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo… |
CVE-2026-27480 | Medium | 5.3 | 2026-02-21 | Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enu… |
CVE-2026-26744 | Medium | 5.3 | 2026-02-19 | A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The applicati… |
CVE-2019-25338 | Medium | 5.3 | 2026-02-12 | DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. A… |
CVE-2026-25509 | Medium | 5.3 | 2026-02-03 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-24664 | Medium | 5.3 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a username enumeration vulnerability al… |
CVE-2026-24332 | Medium | 4.3 | 2026-01-22 | Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a W… |
CVE-2026-23511 | Medium | 5.3 | 2026-01-15 | ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login inter… |
CVE-2026-21484 | Medium | 5.3 | 2026-01-03 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea… |
CVE-2025-69413 | Medium | 5.3 | 2026-01-01 | In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. |
CVE-2025-67874 | Medium | 6.5 | 2025-12-16 | ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent… |
CVE-2025-62181 | Medium | 5.3 | 2025-12-10 | Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration. This issue occurs during user authentication process, where a differe… |
CVE-2025-67500 | Low | 3.7 | 2025-12-10 | Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9… |
CVE-2021-47717 | | | 2025-12-09 | IntelliChoice eFORCE Software Suite 2.5.9 contains a username enumeration vulnerability that allows attackers to enumerate valid users by exploiting the 'ctl00… |
CVE-2025-40806 | Medium | 5.3 | 2025-12-09 | A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeration due to distinguis… |
CVE-2025-65899 | Medium | 5.3 | 2025-12-04 | Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invali… |
CVE-2025-12994 | Medium | 5.3 | 2025-12-04 | Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to dete… |
CVE-2025-66307 | Medium | 6.5 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-59116 | Medium | 5.3 | 2025-11-18 | Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login i… |
CVE-2025-25236 | Medium | 5.3 | 2025-11-12 | Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as t… |
CVE-2025-62236 | Medium | 5.3 | 2025-10-23 | The Frontier Airlines website has a publicly available endpoint that validates if an email addresses is associated with an account. An unauthenticated, remote… |
CVE-2025-34155 | | | 2025-10-23 | Tibbo AggreGate Network Manager < 6.40.05 contains an observable response discrepancy in its login functionality. Authentication failure messages differ based… |
CVE-2025-34255 | Medium | 5.3 | 2025-10-16 | D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint retu… |
CVE-2025-34254 | Medium | 5.3 | 2025-10-16 | D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Login' endpoint returns distin… |
CVE-2025-61907 | Medium | 6.5 | 2025-10-16 | Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could a… |
CVE-2025-61789 | Medium | 5.3 | 2025-10-16 | Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom v… |
CVE-2025-42903 | Medium | 4.3 | 2025-10-14 | A vulnerability in SAP Financial Service Claims Management RFC function ICL_USER_GET_NAME_AND_ADDRESS allows user enumeration and potential disclosure of perso… |
CVE-2025-58586 | Medium | 5.3 | 2025-10-06 | For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existin… |
CVE-2025-56764 | Medium | 5.3 | 2025-09-29 | Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning different error messages ("Unknown user… |
CVE-2025-58442 | Medium | 5.3 | 2025-09-09 | Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of `accountRegister` may r… |
CVE-2025-9824 | Medium | 5.9 | 2025-09-03 | ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after whi… |
CVE-2025-9109 | Low | 3.7 | 2025-08-18 | A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. Affected by this vulnerability is an unknown functionality of the file /password/email… |
CVE-2025-46390 | High | 7.5 | 2025-08-06 | CWE-204: Observable Response Discrepancy |
CVE-2025-54834 | Medium | 5.3 | 2025-07-31 | OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check fo… |