MariaDB 10.6.0 < 10.6.28/ 10.11.0 < 10.11.19/ 11.4.0 < 11.4.13/ 11.8.0 < 11.8.9/ 12.3.0 < 12.3.3/ 13.0.0 < 13.0.2

The version of MariaDB installed on the remote host is prior to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2. It is, therefore, affected by a vulnerability as referenced in the GHSA-g2q2-3936-cp37 advisory. - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until...

CVE-2025-13591

The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user account...

CVE-2025-13591

The authentication endpoint of WSO2 Identity Server is vulnerable to username enumeration because it produces inconsistent system responses when an invalid username is submitted. Attackers can exploit this observable discrepancy to identify valid user accounts within the system. Successful enumer...

EUVD-2025-211119

The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user account...

CVE-2025-13591 Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery

The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user account...

FacturaScripts Cross-Site Scripting Vulnerabilities

FacturaScripts version 2025.61 has a cross-site scripting vulnerability. This vulnerability arises from the application returning different responses for login requests with valid and invalid usernames. Unauthenticated attackers can enumerate valid usernames by analyzing differences in response...

PT-2026-117488

Name of the Vulnerable Software and Affected Versions WSO2 Identity Server affected versions not specified Description The authentication endpoint fails to provide a consistent system response when a username does not exist, allowing attackers to differentiate between valid and invalid usernames...

CVE-2025-13591: Observable Discrepancy

The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user account...

PT-2026-118054

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide BOLA in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

CVE-2026-110324

The visibility check of Gitea user profiles was applied to GET requests only, while POST /username follow and unfollow required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response...

CVE-2026-110324

The visibility check of Gitea user profiles was applied to GET requests only, while "POST /username" follow and unfollow required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the respons...

CVE-2026-110324

The Gitea platform is vulnerable to a private profile information disclosure via a POST request . The vulnerability exists because visibility checks were only enforced on GET requests; the POST /{username} endpoint (used for follow/unfollow actions) only required a signed-in session. Consequently...

EUVD-2026-103990

The visibility check of Gitea user profiles was applied to GET requests only, while POST /username follow and unfollow required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response...

CVE-2026-110324 Gitea private profile information disclosure through POST request

The visibility check of Gitea user profiles was applied to GET requests only, while POST /username follow and unfollow required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response...

CVE-2026-110324 Gitea private profile information disclosure through POST request

The visibility check of Gitea user profiles was applied to GET requests only, while POST /username follow and unfollow required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response...

EUVD-2026-103984

Requesting /username/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for ea...

WSO2 Identity Server side-channel information leakage vulnerability

WSO2 Identity Server versions prior to 7.0.0.134 and 7.1.0.42, WSO2 Carbon Abstract OTP Authenticator versions prior to 1.0.10.2, as well as Email OTP Authenticator versions prior to 1.0.30.5, have a side-channel information leakage vulnerability. This vulnerability arises from the authentication...

PT-2026-117154

The visibility check of Gitea user profiles was applied to GET requests only, while POST /username follow and unfollow required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response...

CVE-2026-110324: Exposure of Sensitive Information to an Unauthorized Actor

The visibility check of Gitea user profiles was applied to GET requests only, while POST /username follow and unfollow required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response...

PT-2026-117147

Requesting /username/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for ea...