linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module

A flaw was found in Linux-PAM's pamuserdb module. This vulnerability, categorized as an Observable Timing Discrepancy CWE-208, allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during...

CVE-2026-18259: Observable Timing Discrepancy

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...

CVE-2026-72700: Observable Timing Discrepancy

The getgrav/grav-plugin-login Composer plugin before 3.9.1 used by Grav compares password reset and account activation tokens using a non-constant-time === string comparison instead of hashequals in classes/Controller.php taskReset and login.php activation handler. Because the token-submission...

CVE-2026-79028: Observable Discrepancy

Observable discrepancy in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-78936: Observable Discrepancy

Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. Chromium security severity: Medium...

PT-2026-81614

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An observable discrepancy in the Scalable Vector Graphics SVG implementation allows a remote attacker to obtain cross-origin data by using a crafted HTML page. Recommendations Update...

PT-2026-81802

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An observable discrepancy in HTML allows a remote attacker to obtain sensitive information by inducing a user to visit a crafted HTML page. Recommendations Update Google Chrome to versi...

PT-2026-81741

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An observable discrepancy in Glic allows a remote attacker to obtain sensitive information by inducing a user to visit a crafted HTML page. Recommendations Update Google Chrome to versi...

PT-2026-81626

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An observable discrepancy in the Network component allows a remote attacker to obtain sensitive information by inducing a user to visit a crafted HTML page. Recommendations Update Googl...

CVE-2026-78949: Observable Discrepancy

Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. Chromium security severity: Medium...

CVE-2026-79030: Observable Discrepancy

Observable discrepancy in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79287: Observable Discrepancy

Observable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79181: Observable Discrepancy

Observable discrepancy in Glic in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

PT-2026-81627

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An observable discrepancy in the Autofill feature allows a remote attacker to obtain sensitive information through the use of a crafted HTML page. Recommendations Update Google Chrome t...

CVE-2026-78955: Observable Discrepancy

Observable discrepancy in PerformanceAPIs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-53525: Observable Timing Discrepancy

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...

CVE-2026-69519

Azure Stack HCI has an observable response discrepancy vulnerability allowing an unauthenticated remote attacker to disclose sensitive information over the network. CVSS 3.1 scores it HIGH (8.6) with network attack vector and no privileges required. No patch version or exploitation details are pr...

Azure Stack HCI Information Disclosure Vulnerability

Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network...

PT-2026-79210

Name of the Vulnerable Software and Affected Versions Azure Stack HCI affected versions not specified Description An observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, there is no information...

EUVD-2026-62847

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/localuser/login.rs returns different errors depending on whether the usernameoremail value exists. LocalUserView::findbyemailorname propagates a NotFound respons...