CVE-2026-70446: Missing Authorization

Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

Missing permission checks in Parameterized-Remote-Trigger allow enumerating credentials IDs

Parameterized-Remote-Trigger 3.2.2 and earlier does not perform permission checks in HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

Missing permission checks in sauce-ondemand allow enumerating credentials IDs

sauce-ondemand 2.2.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

Missing permission checks in aws-codebuild allow enumerating credentials IDs

aws-codebuild 0.59 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

Missing permission checks in codesonar allow enumerating credentials IDs

codesonar 3.6.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability...

CVE-2026-70447: Missing Authorization

Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70438: Missing Authorization

A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

EUVD-2026-39022

Ghost: Member existence leak via magic link sign-in response...

Exploit for Interpretation Conflict in Wordpress

wp2exp2026 🔥 WordPress All-in-One Exploit Framework — De...

Open WebUI: Account enumeration via observable login timing discrepancy

SummaryThe /api/v1/auths/signin endpoint leaked whether an email address belonged to a registered account through a response-time side channel. Password verification ran bcrypt only when the email was found in the database; for a non-existent email the request returned early without hashing. The...

PYSEC-2026-3594 Open WebUI: Account enumeration via observable login timing discrepancy

Summary The /api/v1/auths/signin endpoint leaked whether an email address belonged to a registered account through a response-time side channel. Password verification ran bcrypt only when the email was found in the database; for a non-existent email the request returned early without hashing. The...

CVE-2026-14202

Bilin Software’s HUMANIST Digital Human Resources (versions before 26.1) suffers a username enumeration flaw via observable differences in login responses, enabling account footprinting. CVSS 3.1 base score 5.3 (Network, Low attack complexity, No privileges, No user interaction). Exploitation sta...

CVE-2026-14202 Username Enumeration via Differential Login Responses in Bilin Software's HUMANIST Digital Human Resources

Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14202 Username Enumeration via Differential Login Responses in Bilin Software's HUMANIST Digital Human Resources

Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

Exploit for Injection in Vm2_Project Vm2

Hack The Box — Codify Writeup !Difficultyhttps://img.shiel...

WordPress Quiz and Survey Master (QSM) plugin < 11.1.3 - Unauthenticated User Enumeration and Password Oracle vulnerability

Unauthenticated User Enumeration and Password Oracle vulnerability discovered by Ahmad Mubarak Alanazi in WordPress Plugin Quiz And Survey Master versions 11.1.3...

CVE-2026-8794

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a...

CVE-2026-8794

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a...

CVE-2026-8794 PaperCut NG/MF: User enumeration via timing attack

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a...

CVE-2026-8794

PaperCut NG/MF is affected by a timing-based user enumeration vulnerability in its authentication component. An unauthenticated remote attacker can detect whether a login target exists by measuring response times, since the system only performs a password hash comparison after confirming a valid ...