CVE-2026-110141

An observable discrepancy flaw was found in the Media component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/568895734...

Dify User Enumeration via Observable Response Discrepancy

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue. id: CVE-2026-28288 info: name: Dify User Enumeratio...

CVE-2017-12635

CVE-2017-12635 Case study and PoC of CVE-2017-12635 Apache CouchDB 1.7.0 / 2.x 2.1.1 - Remote Privilege Escalation Presentation CouchDB Apache CouchDB is a document-oriented NoSQL database, implemented in Erlang. CouchDB uses multiple formats and protocols to store, transfer, and process it's dat...

CVE-2026-109379

A flaw was found in Cockpit. An observable timing discrepancy in the authentication mechanism allows an unauthenticated remote attacker to enumerate valid user accounts. By submitting login requests and measuring response times, an attacker can identify whether a username or email address exists...

CVE-2026-109379

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

CVE-2026-109379 Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

EUVD-2026-97877

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

CVE-2026-109379

Cockpit CMS 2.14.1 is affected by an observable timing discrepancy vulnerability within the /auth/check endpoint. Due to an incomplete timing fix, an unauthenticated remote attacker can enumerate valid user accounts by submitting login requests and measuring the processing duration. The vulnerabi...

CVE-2026-109379 Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

echteeteepee

HTTP/1 Desync Vulnerability Testing Tools This repository contains defensive security tools for detecting HTTP/1 request smuggling desync vulnerabilities based on groundbreaking research by James Kettle of PortSwigger. Research Attribution This work is directly inspired by and implements techniqu...

CVE-2021-45901

CVE-2021-45901 ServiceNow - Username Enumeration PoC Code enumSNOWUsers.py - SNOW User Enumerator Title Username Enumeration Vulnerability found in ServiceNow Application Published: Version: 1.0 Vendor: ServiceNow Product: ServiceNow https://www.servicenow.com/ Version affected: Orlando...

CVE-2025-68621

CVE-2025-68621 — Trilium Notes Timing Attack on /api/login/sync Severity: HIGH CVSS 7.4 Affected Software: TriliumNext/Trilium 0.101.0 Vulnerability Type: CWE-208 – Observable Timing Discrepancy Fixed In: Trilium 0.101.0 PR 8129 Published: 2026-02-06 | Reserved: 2025-12-19 Table of Contents 1. My...

CVE-2025-46047

CVE-2025-46047 Silverpeas = 6.4.2 Username Enumeration PoC Proof-of-Concept script for demonstrating a username enumeration vulnerability in Silverpeas versions 6.4.1 and 6.4.2. Vulnerability Details Affected Software: Silverpeas Affected Versions: 6.4.1, 6.4.2 and potentially earlier versions...

CVE-2026-106351

An observable discrepancy flaw was found in the Safebrowsing component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553164077...

CVE-2026-106303

An observable discrepancy flaw was found in the Autofill AI component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517475258...

CVE-2026-106180

An observable discrepancy flaw was found in the Animation component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517429254...

CVE-2026-64638

CVE-2026-64638 — XSS2Shell: WordPress Login Page Pre-Auth XSS → Server RCE HackSpeak distribution mirror. This repository is a distribution mirror of the educational XSS2Shell PoC CVE-2026-64638 released by WordSec , with code identical to upstream; upstream is MIT License, Copyright c 2026...

spring-cvss-check

spring-cvss-check Covers 15 official Spring / Tomcat security advisories seven from 2026-08-20 · five from 2026-06-08 · one from 2025-09-15 · two Tomcat from 2026-08-25. For 8 of them, scanners pulling from NVD reportCRITICAL 9.19.8, while the vendor's official rating is LOW / MEDIUM. For the oth...

CVE-2026-XXXX-atlassian-email-enumeration

CVE-2026-XXXX: Atlassian Central GraphQL — Email Enumeration Oracle Product Atlassian Central GraphQL Gateway api.atlassian.com/graphql Vulnerability Type CWE-204: Observable Response Discrepancy — Email Enumeration Oracle Severity MEDIUM — CVSS 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Description...

CVE-2025-65899

CVE-2025-65899: Kalmia CMS v0.2.0 - is vulnerable to Observable Response Discrepancy Vulnerability Overview CVE ID: CVE-2025-65899 Product: DifuseHQ Kalmia CMS Affected Version: 0.2.0 Vulnerability Type: Observable Response Discrepancy Privileges Required: None Impact Allows unauthenticated...