Dify User Enumeration via Observable Response Discrepancy

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue. id: CVE-2026-28288 info: name: Dify User Enumeratio...

CVE-2026-69519

Azure Stack HCI has an observable response discrepancy vulnerability allowing an unauthenticated remote attacker to disclose sensitive information over the network. CVSS 3.1 scores it HIGH (8.6) with network attack vector and no privileges required. No patch version or exploitation details are pr...

Azure Stack HCI Information Disclosure Vulnerability

Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network...

PT-2026-79210

Name of the Vulnerable Software and Affected Versions Azure Stack HCI affected versions not specified Description An observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, there is no information...

EUVD-2026-62847

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/localuser/login.rs returns different errors depending on whether the usernameoremail value exists. LocalUserView::findbyemailorname propagates a NotFound respons...

CVE-2026-54570

AngleSharp versions prior to 1.5.0 fail to assign NodeFlags.HtmlTip to MathAnnotationXmlElement, causing token dispatch to route through foreign-content parsing instead of HTML parsing. Combined with unescaped characters in attribute values, this allows an attacker to hide malicious elements fro...

Moderate: Red Hat Security Advisory: pam security update

An update for pam is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

CVE-2026-19965

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

CVE-2026-19965 automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

EUVD-2026-60010

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

CVE-2026-19965 automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

CVE-2026-19965

The CVE-2026-19965 affects automad up to version 2.0.0-beta.32. It targets the Password Reset Endpoint’s requestPasswordResetToken in automad/src/server/Controllers/API/UserController.php, where manipulation of the name-or-email argument causes observable response discrepancies. The issue can be ...

CVE-2026-72632

Kibana Fleet vulnerability CVE-2026-72632 allows an information disclosure of Elasticsearch API keys through a side-channel in the agent listing API. Root cause: Fleet evaluated caller-supplied filter expressions against the stored API-key field using Kibana’s internal Elasticsearch privileges, l...

ALPINE-CVE-2026-14672

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scramiterations count, because the authentication challenge for a...

CVE-2026-14672 PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scramiterations count, because the authentication challenge for a...

CVE-2026-14672

CVE-2026-14672 describes an observable response discrepancy in PostgreSQL SCRAM authentication that can let an unauthenticated user infer the existence of a target user by observing the SCRAM iteration count. The issue requires the probed user to have a non-default scram_iterations value, since a...

CVE-2026-59502

: Observable Discrepancy vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-59502

CWE-203: Observable Discrepancy...

EUVD-2026-57769

CWE-203: Observable Discrepancy...

CVE-2026-59502

Technical details (affected product/component, root cause, impact, versions, or exploitation) are not provided in the connected documents. Monitor for updates regarding CVE-2026-59502.