CVE-2017-12635

CVE-2017-12635 Case study and PoC of CVE-2017-12635 Apache CouchDB 1.7.0 / 2.x 2.1.1 - Remote Privilege Escalation Presentation CouchDB Apache CouchDB is a document-oriented NoSQL database, implemented in Erlang. CouchDB uses multiple formats and protocols to store, transfer, and process it's dat...

EUVD-2026-84199

Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login incomplete fix of the prior timing-attack advisory...

CVE-2026-95270

A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function checkpassword of the file changedetectionio/flaskapp.py of the component Hash Comparison. This manipulation of the argument Password causes observable timing discrepancy. The attack is possible...

CVE-2026-95270

dgtlmoon changedetection.io versions up to 0.60.7 are affected by a timing discrepancy in the check_password function within changedetectionio/flask_app.py (component Hash Comparison , CWE-208 ). An attacker can remotely exploit the observable timing difference when manipulating the Password argu...

Dify User Enumeration via Observable Response Discrepancy

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue. id: CVE-2026-28288 info: name: Dify User Enumeratio...

echteeteepee

HTTP/1 Desync Vulnerability Testing Tools This repository contains defensive security tools for detecting HTTP/1 request smuggling desync vulnerabilities based on groundbreaking research by James Kettle of PortSwigger. Research Attribution This work is directly inspired by and implements techniqu...

CVE-2021-45901

CVE-2021-45901 ServiceNow - Username Enumeration PoC Code enumSNOWUsers.py - SNOW User Enumerator Title Username Enumeration Vulnerability found in ServiceNow Application Published: Version: 1.0 Vendor: ServiceNow Product: ServiceNow https://www.servicenow.com/ Version affected: Orlando...

CVE-2025-68621

CVE-2025-68621 — Trilium Notes Timing Attack on /api/login/sync Severity: HIGH CVSS 7.4 Affected Software: TriliumNext/Trilium 0.101.0 Vulnerability Type: CWE-208 – Observable Timing Discrepancy Fixed In: Trilium 0.101.0 PR 8129 Published: 2026-02-06 | Reserved: 2025-12-19 Table of Contents 1. My...

CVE-2025-46047

CVE-2025-46047 Silverpeas = 6.4.2 Username Enumeration PoC Proof-of-Concept script for demonstrating a username enumeration vulnerability in Silverpeas versions 6.4.1 and 6.4.2. Vulnerability Details Affected Software: Silverpeas Affected Versions: 6.4.1, 6.4.2 and potentially earlier versions...

CVE-2026-64638

CVE-2026-64638 — XSS2Shell: пред-авторизованный XSS на странице входа WordPress → RCE на сервере Зеркало дистрибутива HackSpeak. Этот репозиторий является зеркалом образовательного PoC XSS2Shell CVE-2026-64638, опубликованного WordSec , код идентичен оригиналу; оригинал — MIT License, Copyright c...

Chromium CVE-2026-91725: Observable discrepancy

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releaseshttps://chromereleases.googleblog.com/2026 for more information...

Chromium CVE-2026-91714: Observable discrepancy

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releaseshttps://chromereleases.googleblog.com/2026 for more information...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-69247, CVE-2026-69248, CVE-2026-69249)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package...

CVE-2025-65899

CVE-2025-65899: Kalmia CMS v0.2.0 — уязвим к Observable Response Discrepancy Обзор уязвимости CVE ID: CVE-2025-65899 Продукт: DifuseHQ Kalmia CMS Затронутая версия: 0.2.0 Тип уязвимости: Observable Response Discrepancy Требуемые привилегии: Нет Воздействие Позволяет неаутентифицированным...

spring-cvss-check

spring-cvss-check 覆盖 15 条 Spring / Tomcat 官方安全公告2026-08-20 七条 · 2026-06-08 五条 · 2025-09-15 一条 · Tomcat 2026-08-25 两条。 其中 8 条,接 NVD 的扫描器报CRITICAL 9.19.8,而厂商官方评的是 LOW / MEDIUM。 另外 7 条两边评级完全一致 —— 差别只有一个:厂商有没有自己给 CVE 记录提交 CVSS 分数。 这个工具回答四个问题: 1. 你的版本中了这 15 条里的哪几条 2. 官方到底评多少分以及 NVD 上那个分是谁打的 3...

CVE-2026-XXXX-atlassian-email-enumeration

CVE-2026-XXXX: Atlassian Central GraphQL — メール列挙オラクル 製品 Atlassian Central GraphQL Gateway （api.atlassian.com/graphql） 脆弱性タイプ CWE-204: Observable Response Discrepancy — メール列挙オラクル 深刻度 MEDIUM — CVSS 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 説明 Atlassian の中央 GraphQL ゲートウェイ上の...

CVE-2026-91714

An observable discrepancy flaw was found in the Fonts component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517710554...

CVE-2026-91725

An observable discrepancy flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=518032534...

CVE-2026-91725

Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. Chromium security severity: Medium...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in cryptography

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in cryptography Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0,...