1913 matches found
CVE-2026-72700 Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison
The getgrav/grav-plugin-login Composer plugin before 3.9.1 used by Grav compares password reset and account activation tokens using a non-constant-time === string comparison instead of hashequals in classes/Controller.php taskReset and login.php activation handler. Because the token-submission...
CVE-2026-72700
The getgrav/grav-plugin-login Composer plugin (used by Grav CMS ) before version 3.9.1 compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because...
CVE-2026-72701: Observable Timing Discrepancy
Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce that uses non-constant-time string comparison with the === operator instead of hashequals for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonce values byte-by-byte through...
PT-2026-81144
Name of the Vulnerable Software and Affected Versions Grav CMS versions prior to 2.0.16 Description An issue exists in the verifyNonce function of the Utils class where non-constant-time string comparison is performed using the === operator instead of hash equals for CSRF nonce validation. This...
CVE-2026-72700: Observable Timing Discrepancy
The getgrav/grav-plugin-login Composer plugin before 3.9.1 used by Grav compares password reset and account activation tokens using a non-constant-time === string comparison instead of hashequals in classes/Controller.php taskReset and login.php activation handler. Because the token-submission...
PT-2026-81143
The getgrav/grav-plugin-login Composer plugin before 3.9.1 used by Grav compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash equals in classes/Controller.php taskReset and login.php activation handler. Because the token-submission...
CVE-2026-53525
A flaw was found in WeeChat, a free chat client. The relay authentication mechanism uses a non-constant-time comparison when verifying password hashes. This vulnerability allows a remote attacker to exploit subtle timing differences during the authentication process. By analyzing these timing...
Security update for the Linux Kernel (Live Patch 32 for SUSE Linux Enterprise 15 SP5)
This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.127 fixes various security issues: The following security issues were fixed: CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1269284. CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk...
SUSE-SU-2026:3703-1 Security update for the Linux Kernel (Live Patch 30 for SUSE Linux Enterprise 15 SP5)
This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.121 fixes various security issues: The following security issues were fixed: - CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1269284. - CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT...
apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation
A flaw was found in Apache Portable Runtime Utility apr-util. The aprpasswordvalidate function does not perform constant-time comparisons for hashes or passwords. This vulnerability allows a remote attacker to conduct a timing attack, particularly on platforms without crypt such as Windows, BeOS,...
CVE-2026-53525
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...
CVE-2026-53525
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...
EUVD-2026-64186
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...
CVE-2026-53525 WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...
CVE-2026-53525
WeeChat (a free chat client) versions 0.3.1 through 4.9.0 are affected by a timing side-channel in relay authentication. The relay uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp ) to verify password hashes and plaintext passwords. An attacker can exploit timing ...
CVE-2026-53525
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...
CVE-2026-53525 WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...
SUSE CVE-2026-75589
Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...
CVE-2026-53525: Observable Timing Discrepancy
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...
