CVE-2026-107269

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

CVE-2026-107269 Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

EUVD-2026-94398

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

CVE-2026-107269

Versions of Gophish through 0.12.1 are vulnerable to a timing discrepancy in the AdminServer.Login function. This flaw allows unauthenticated attackers to perform username enumeration by measuring response times during a POST /login request. Specifically, the application exhibits different delays...

CVE-2026-107269 Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

PT-2026-107566

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

Astra Linux – Vulnerability in Intel Microcode

Observable timing discrepancies in some Intel processors may allow an authenticated user to potentially enable information disclosure through local access...

CVE-2025-68621

CVE-2025-68621 — Ataque de temporización en Trilium Notes sobre /api/login/sync Gravedad: ALTA CVSS 7.4 Software afectado: TriliumNext/Trilium 0.101.0 Tipo de vulnerabilidad: CWE-208 – Discrepancia de temporización observable Corregido en: Trilium 0.101.0 PR 8129 Publicado: 2026-02-06 | Reservado...

CVE-2026-18040: Observable Timing Discrepancy

In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF2^8 arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a...

CVE-2026-18036: Observable Timing Discrepancy

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

AlmaLinux 9.2 [TuxCare] Security Update: pam / pam-devel / pam-docs (ALMALINUX9.2:CLSA-2026:1788971665)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788971665 advisory. - Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

Rocky Linux 8 [CIQ] Security Update: microcode_ctl Multiple Vulnerabilities (crlsa-2021_2308)

The Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20212308 advisory. hw: vt-d related privilege escalation CVE-2020-24489 hw: improper isolation of shared resources in some Intel Processors CVE-2020-24511 hw: observable timi...

Rocky Linux 9.6 [TuxCare] Security Update: pam / pam-devel / pam-docs (ALMALINUX9.6:CLSA-2026:1789472351)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789472351 advisory. - Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

AlmaLinux 9.6 [TuxCare] Security Update: pam / pam-devel / pam-docs (ALMALINUX9.6:CLSA-2026:1789472351)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789472351 advisory. - Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

Rocky Linux 8 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel (crlsa-2026_56131)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202656131 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly fro...

Rocky Linux 9 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel / pam-docs (crlsa-2026_64815)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202664815 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly fro...

Rocky Linux 10.2 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel / pam-libs / etc (crlsa-2026_59379)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202659379 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly...

CVE-2026-54875: Observable Timing Discrepancy

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...

CVE-2026-54875: Observable Timing Discrepancy

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...

CVE-2026-54872: Observable Timing Discrepancy

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...