CVE-2026-78584

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

CVE-2026-XXXX-atlassian-email-enumeration

CVE-2026-XXXX: Atlassian Central GraphQL — メール列挙オラクル 製品 Atlassian Central GraphQL Gateway （api.atlassian.com/graphql） 脆弱性タイプ CWE-204: Observable Response Discrepancy — メール列挙オラクル 深刻度 MEDIUM — CVSS 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 説明 Atlassian の中央 GraphQL ゲートウェイ上の...

CVE-2025-46047

CVE-2025-46047 Silverpeas = 6.4.2 ユーザー名列挙 PoC Silverpeas バージョン 6.4.1 および 6.4.2 におけるユーザー名列挙の脆弱性を実証するための Proof-of-Concept スクリプト。 脆弱性の詳細 影響を受けるソフトウェア: Silverpeas 影響を受けるバージョン: 6.4.1、6.4.2（およびそれ以前のバージョンの可能性あり） 修正済みバージョン: 6.4.3 脆弱性の種類: 観測可能な応答の不一致によるユーザー名列挙（CWE-204） ベンダートラッキング ID: Silverpeas Bug 14829...

Dify User Enumeration via Observable Response Discrepancy

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue. id: CVE-2026-28288 info: name: Dify User Enumeratio...

CVE-2025-65899

CVE-2025-65899: Kalmia CMS v0.2.0 - 観測可能なレスポンスの相違（Observable Response Discrepancy）に対して脆弱 脆弱性概要 CVE ID: CVE-2025-65899 製品: DifuseHQ Kalmia CMS 影響を受けるバージョン: 0.2.0 脆弱性タイプ: Observable Response Discrepancy（観測可能なレスポンスの相違） 必要な権限: なし 影響...

CVE-2026-81033 Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...

CVE-2026-81033 Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...

CVE-2026-69519

Azure Stack HCI has an observable response discrepancy vulnerability allowing an unauthenticated remote attacker to disclose sensitive information over the network. CVSS 3.1 scores it HIGH (8.6) with network attack vector and no privileges required. No patch version or exploitation details are pr...

Azure Stack HCI Information Disclosure Vulnerability

Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network...

PT-2026-79210

Name of the Vulnerable Software and Affected Versions Azure Stack HCI affected versions not specified Description An observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, there is no information...

EUVD-2026-62847

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/localuser/login.rs returns different errors depending on whether the usernameoremail value exists. LocalUserView::findbyemailorname propagates a NotFound respons...

CVE-2026-19965

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

EUVD-2026-60010

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

CVE-2026-19965 automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

CVE-2026-19965 automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

CVE-2026-19965

The CVE-2026-19965 affects automad up to version 2.0.0-beta.32. It targets the Password Reset Endpoint’s requestPasswordResetToken in automad/src/server/Controllers/API/UserController.php, where manipulation of the name-or-email argument causes observable response discrepancies. The issue can be ...

ALPINE-CVE-2026-14672

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scramiterations count, because the authentication challenge for a...

CVE-2026-14672 PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scramiterations count, because the authentication challenge for a...

CVE-2026-14672

CVE-2026-14672 describes an observable response discrepancy in PostgreSQL SCRAM authentication that can let an unauthenticated user infer the existence of a target user by observing the SCRAM iteration count. The issue requires the probed user to have a non-default scram_iterations value, since a...

PT-2026-71470

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 16.0 through 16.14 PostgreSQL versions 17.0 through 17.10 PostgreSQL versions 18.0 through 18.4 Description A discrepancy in the responses of the SCRAM authentication subsystem allows an unauthenticated remote attacker to...