CVE-2026-39321 Parse Server has a login timing side-channel reveals user existence

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.6 and 8.6.74, he login endpoint response time differs measurably depending on whether the submitted username or email exists in the database. When a user is not found, the...

CVE-2026-26895

User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform...

CVE-2026-26895

User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform...

CVE-2026-26895

User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform...

PT-2026-29802

User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform...

osTicket 安全漏洞

osTicket is a widely used and trusted open-source support ticket system by the osTicket company. Version 1.18.2 of osTicket contains a security vulnerability. This vulnerability stems from a user enumeration issue in the pwreset.php file, which could allow remote attackers to enumerate valid...

CVE-2026-26895

User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform...

CVE-2026-26895

User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform...

CVE-2026-26895

User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform...

CVE-2026-26895

The issue is a user enumeration vulnerability in osTicket v1.18.2, exposed via /pwreset.php, allowing remote attackers to enumerate valid usernames registered on the platform. The description consistently refers to a username enumeration flaw without detailing the root cause beyond the vulnerable...

CVE-2025-3716

User enumeration in ESET Protect on-prem via Response Timing...

EUVD-2025-209122

User enumeration in ESET Protect on-prem via Response Timing...

CVE-2025-3716

User enumeration in ESET Protect on-prem via Response Timing...

CVE-2025-3716

User enumeration in ESET Protect on-prem via Response Timing...

CVE-2025-3716 User enumeration in ESET Protect (on-prem)

User enumeration in ESET Protect on-prem via Response Timing...

CVE-2025-3716 User enumeration in ESET Protect (on-prem)

User enumeration in ESET Protect on-prem via Response Timing...

PT-2026-28804

User enumeration in ESET Protect on-prem via Response Timing...

ESET Protect 安全漏洞

ESET Protect is an enterprise-level endpoint security management platform developed by ESET Singapore. ESET Protect has a security vulnerability, which stems from response times that lead to user enumeration...

CVE-2026-33638

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, GET /api/allusers is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. ...

SUSE CVE-2026-24031

Dovecot SQL based authentication can be bypassed when authusernamechars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear authusernamechars. If this is not possible, install latest fixed version. No publicly available exploits...