8944 matches found
CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for...
CVE-2026-58272
Sync-in Server (open-source file storage and collaboration platform) prior to 2.4.1 exposes a timing side-channel on the POST /api/auth/login endpoint. The root cause is that authentication attempts for nonexistent accounts skip the bcrypt comparison performed for existing accounts, producing a m...
CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for...
MAL-2026-16353 Malicious code in @insiderintelligence/componentlibrary (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4451c41559202c6bce3218de9af47cabe20288af5f3a9240076f25b3b2b5993 The package declares scripts.install: node index.js, so npm install auto-executes index.js which loads runtime/support/telemetry/probe/impl.js. That...
K000163349: Gnutls vulnerability CVE-2026-5419
Security Advisory Description A flaw was found in gnutls. The PKCS7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. Th...
chromium-browser: skia: chromium-browser: skia: Side-channel information leakage in Skia
A side-channel information leakage flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=506377118...
CVE-2026-77568
Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrffield, csrftoken, and csrfprotect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an...
UBUNTU-CVE-2026-77568
Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrffield, csrftoken, and csrfprotect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an...
CVE-2026-77568
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-2026-15747. Notes: All CVE users should reference CVE-2026-15747 instead of this candidate...
CVE-2026-77568 Mojolicious: CSRF tokens are vulnerable to BREACH attacks
Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrffield, csrftoken, and csrfprotect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an...
PT-2026-95476
Name of the Vulnerable Software and Affected Versions Mojolicious versions prior to 9.48 Description The CSRF helpers csrf field, csrf token, and csrf protect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected i...
Linux Distros Unpatched Vulnerability : CVE-2026-90110
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on t...
EulerOS Virtualization 2.11.0 : shim (EulerOS-SA-2026-3560)
According to the versions of the shim package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext acros...
EulerOS Virtualization 2.11.1 : shim (EulerOS-SA-2026-3473)
According to the versions of the shim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext acro...
EulerOS Virtualization 2.11.1 : openssl (EulerOS-SA-2026-3448)
According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to...
CVE-2026-92962
A flaw was found in vm2, a sandbox for running untrusted JavaScript. Malicious code running within the sandbox can exploit a weakness in how stack traces are handled. By manipulating the Array.prototype, an attacker can observe and intercept individual lines of stack traces, leading to an...
CVE-2026-90110
In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using...
AZL-103026 CVE-2026-90110 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using...
DEBIAN-CVE-2026-90110
In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using...