CVE-2026-77582: Observable Timing Discrepancy

Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/usercontroller.go loginHandler and...

CVE-2026-58272: Observable Timing Discrepancy

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for...

PT-2026-96251

Name of the Vulnerable Software and Affected Versions Sync-in Server versions prior to 2.4.1 Description An observable timing discrepancy exists in the login process. When an authentication attempt is made for a nonexistent account, the system returns a response immediately without performing the...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-69247, CVE-2026-69248, CVE-2026-69249)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in cryptography

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in cryptography Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0,...

CVE-2026-70658: Observable Timing Discrepancy

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

CVE-2023-24035: Observable Timing Discrepancy

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

MiracleLinux 9 : pam-1.5.1-28.el9_8.1 (AXSA:2026-1797:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1797:03 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block direct...

pam security update

An update is available for pam. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Pluggable Authentication Modules PAM provide a system to set up authentication...

RLSA-2026:64815 Moderate: pam security update

Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 For more details about the...

AlmaLinux 9 : pam (ALSA-2026:64815)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:64815 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly fr...

RockyLinux 9 : pam (RLSA-2026:64815)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:64815 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly...

CVE-2026-16037

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

EUVD-2026-72853

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module

A flaw was found in Linux-PAM's pamuserdb module. This vulnerability, categorized as an Observable Timing Discrepancy CWE-208, allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during...

Moderate: Red Hat Security Advisory: pam security update

An update for pam is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

CVE-2026-16037: Observable Timing Discrepancy

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

RHEL 9 : pam (RHSA-2026:64815)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:64815 advisory. Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle...

ALSA-2026:64815 Moderate: pam security update

Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 For more details about the...

Moderate: pam security update

Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 For more details about the...