CVE-2026-81531 Unauthenticated Account Information Disclosure in Multiple Omada Controllers

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker...

CVE-2026-81531

CVE-2026-81531 affects Omada Controller (multiple versions, per the CNA title). An API endpoint intended for Controller initialization remains accessible after the initialization process completes, allowing unauthenticated remote users to query it and obtain account-related information . Successf...

EUVD-2026-73160

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker...

PrestaShop - Information Disclosure

User enumeration vulnerability in the AdminLogin controller in PrestaShop 1.7 through 8.2.2 allows remote attackers to obtain administrators user email addresses via manipulation of the idemployee and resettoken parameters. An attacker who has access to the Back Office login URL can trigger the...

PT-2026-87123

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 Description An information disclosure issue exists in the 'restreamsActive.json.php' endpoint. Authenticated users with streaming capabilities can enumerate the identities and source stream keys of active restream...

PT-2026-87186

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker...

CVE-2026-81531: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker...

SUSE CVE-2026-55496

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive ...

CVE-2026-19205 User Enumeration in GastroMenum's GastroMenum Web Panel

Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: before 31.08.2026...

CVE-2026-19205

CVE-2026-19205 is a user enumeration vulnerability in the GastroMenum Web Panel , caused by an observable response discrepancy that allows account footprinting . The vulnerability is exploitable over the network with low complexity and no privileges required, yielding a CVSS 3.1 score of 7.5 (HIG...

CVE-2026-19205 User Enumeration in GastroMenum's GastroMenum Web Panel

Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: before 31.08.2026...

CVE-2026-85210

Oppia (through 3.5.2) has a missing authorization flaw in the AdminRoleHandler GET endpoint located in core/controllers/admin.py. The endpoint is decorated with open_access , which allows any registered user to query it using filter_criterion parameters and retrieve usernames holding specific rol...

CVE-2026-78153

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...

CVE-2026-78153 Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...

CVE-2026-14672

An observable response discrepancy in PostgreSQL's SCRAM authentication permits user enumeration. Unauthenticated attackers can verify if a specific user exists by observing the authentication iteration count, provided the targeted user is configured with a non-default scramiterations value...

PostgreSQL 16.x < 16.15 / 17.x < 17.11 / 18.x < 18.6 SCRAM Observable Response Discrepancy

The version of PostgreSQL installed on the remote host is 16 prior to 16.15, 17 prior to 17.11, or 18 prior to 18.6. As such, it is potentially affected by an information disclosure vulnerability: - Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user ...

CVE-2026-37064

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...

CVE-2026-11754 User Enumeration in Seres Software's syWEB

Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-11754

An observable discrepancy vulnerability in Seres Software syWEB (affecting versions through 27082026) allows Account Footprinting , also described as User Enumeration . The CVSS 3.1 score is 5.3 (MEDIUM) with a network attack vector, low complexity, no required privileges, no user interaction, an...

CVE-2026-37064

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...