10881 matches found
CVE-2026-23849
File Browser provides a file managing interface within a specified directory and can be used to upload, delete, preview, rename, and edit files. Prior to version 2.55.0, the JSONAuth. Auth function contains a logic flaw that allows unauthenticated attackers to enumerate valid usernames by measuri...
CVE-2026-23849 File Browser vulnerable to Username Enumeration via Timing Attack in /api/login
File Browser provides a file managing interface within a specified directory and can be used to upload, delete, preview, rename, and edit files. Prior to version 2.55.0, the JSONAuth. Auth function contains a logic flaw that allows unauthenticated attackers to enumerate valid usernames by measuri...
CVE-2026-23849
CVE-2026-23849 – File Browser (github.com/filebrowser/filebrowser) shows a timing-based username enumeration flaw in the /api/login flow. The JSONAuth.Auth logic short-circuits when a user is not found, returning quickly, while a valid user triggers bcrypt password verification (users.CheckPwd) w...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft
CVE-2026-20805-PoC The PoC of information disclosure in Micros...
CVE-2026-23721
OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visible to users that have the View Members permission in any project that the group is also a member of. Prior to versions 17.0.1 and 16.6.5, d...
CVE-2026-23721 OpenProject users with "View Members" permission in any project can view all Group memberships
OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visible to users that have the View Members permission in any project that the group is also a member of. Prior to versions 17.0.1 and 16.6.5, d...
EUVD-2026-3307
OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visible to users that have the View Members permission in any project that the group is also a member of. Prior to versions 17.0.1 and 16.6.5, d...
PT-2026-3502
Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.55.0 Description File Browser provides a file managing interface for tasks like uploading, deleting, and editing files. A flaw in the JSONAuth.Auth function allows unauthenticated attackers to identify valid...
OpenProject security vulnerabilities
OpenProject is an open-source web-based project management software. Versions of OpenProject prior to 17.0.1 and 16.6.5 had security vulnerabilities. These vulnerabilities stemmed from failed permission checks, which could allow users with viewing member permissions to enumerate all groups and...
FileBrowser security vulnerability
FileBrowser is a web-based file browser developed by Seagate as open source. It provides a file management interface for specified directories, allowing users to upload, delete, preview, rename, and edit their files. It supports multiple users, with each user having their own directories...
CVE-2026-1020
Police Statistics Database System developed by Gotac has a Absolute Path Traversal vulnerability, allowing unauthenticated remote attackers to enumerate the system file directory...
CVE-2026-23511
ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames an...
CVE-2025-24090
CVE-2025-24090 affects Apple's iOS 18.3 and iPadOS 18.3. The issue is a permissions flaw that could allow an app to enumerate a user’s installed apps. Root cause described as a permissions issue addressed with additional restrictions; Apple notes the fix is included in iOS 18.3/iPadOS 18.3. Explo...
CVE-2026-1020
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
Code-Projects Police Station Management System Security Vulnerabilities
Code-Projects Police Station Management System is an open-source police station management system developed by Code-Projects. The Code-Projects Police Station Management System has a security vulnerability that can be exploited by absolute path traversal attacks, which may lead to the enumeration...
MiracleLinux 7 : openssh-7.4p1-21.el7 (AXSA:2019-4118:02)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2019-4118:02 advisory. openssh: User enumeration via malformed packets in authentication requests CVE-2018-15473 Tenable has extracted the preceding description block directly from...
PT-2026-3265
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's installed apps...
MiracleLinux 4 : openssh-5.3p1-123.AXS4 (AXSA:2017-2173:02)
The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-2173:02 advisory. A covert timing channel flaw was found in the way OpenSSH handled authentication of non-existent users. A remote unauthenticated attacker could possibly use...
CVE-2026-23511
ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames an...