CVE-2026-109379

A flaw was found in Cockpit. An observable timing discrepancy in the authentication mechanism allows an unauthenticated remote attacker to enumerate valid user accounts. By submitting login requests and measuring response times, an attacker can identify whether a username or email address exists...

CVE-2026-109379

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

CVE-2026-109379 Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

EUVD-2026-97877

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

CVE-2026-109379

Cockpit CMS 2.14.1 is affected by an observable timing discrepancy vulnerability within the /auth/check endpoint. Due to an incomplete timing fix, an unauthenticated remote attacker can enumerate valid user accounts by submitting login requests and measuring the processing duration. The vulnerabi...

CVE-2025-68621

CVE-2025-68621 — Trilium Notes Timing Attack on /api/login/sync Severity: HIGH CVSS 7.4 Affected Software: TriliumNext/Trilium 0.101.0 Vulnerability Type: CWE-208 – Observable Timing Discrepancy Fixed In: Trilium 0.101.0 PR 8129 Published: 2026-02-06 | Reserved: 2025-12-19 Table of Contents 1. My...

EulerOS 2.0 SP15 : pam (EulerOS-SA-2026-3997)

According to the versions of the pam packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

EulerOS 2.0 SP15 : pam (EulerOS-SA-2026-3931)

According to the versions of the pam packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

CVE-2026-107269

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

EUVD-2026-94398

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

CVE-2026-107269

Versions of Gophish through 0.12.1 are vulnerable to a timing discrepancy in the AdminServer.Login function. This flaw allows unauthenticated attackers to perform username enumeration by measuring response times during a POST /login request. Specifically, the application exhibits different delays...

CVE-2026-107269 Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

CVE-2026-107269 Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

CVE-2026-107269: Observable Timing Discrepancy

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

PT-2026-107566

Name of the Vulnerable Software and Affected Versions Gophish versions prior to 0.12.2 Description A timing discrepancy exists in the AdminServer.Login function. Unauthenticated attackers can enumerate valid usernames by submitting candidate names to the 'POST /login' endpoint and measuring the...

Astra Linux – Vulnerability in Intel Microcode

Observable timing discrepancies in some Intel processors may allow an authenticated user to potentially enable information disclosure through local access...

CVE-2026-18040: Observable Timing Discrepancy

In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF2^8 arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a...

CVE-2026-18036: Observable Timing Discrepancy

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

AlmaLinux 9.2 [TuxCare] Security Update: pam / pam-devel / pam-docs (ALMALINUX9.2:CLSA-2026:1788971665)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788971665 advisory. - Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

Rocky Linux 8 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel (crlsa-2026_56131)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202656131 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly fro...