# CWE-204. Every Advisory and CVE whose sources give the weakness CWE-204, newest first. ## Records, newest first (an older page) - [Vantage6: Set admin user and password from environment or configuration](https://agentprime.io/advisories/GHSA-fgmc-2hqj-86v4.md) `GHSA-fgmc-2hqj-86v4`, `CVE-2026-54445`, `PYSEC-2026-3400` · PyPI `vantage6`: affected `<5.0.0`, fixed in `5.0.0` · CVSS 6.9 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: CWE-204, CWE-1393 - [FOSSBilling's password reset confirmation endpoint lacks rate limiting](https://agentprime.io/advisories/CVE-2026-43926.md) `CVE-2026-43926` · CVE record: FOSSBilling FOSSBilling · CVSS 6.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Authentication bypass, CWE-204 - [FreeScout: User Account Enumeration via Password Reset Response Differentiation](https://agentprime.io/advisories/CVE-2026-45294.md) `CVE-2026-45294` · CVE record: freescout-help-desk freescout · CVSS 5.3 Medium · Not analysed yet · Published 29 May 2026 · Tags: Information disclosure, CWE-204 - [userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php](https://agentprime.io/advisories/CVE-2018-25350.md) `CVE-2018-25350` · CVE record: UserSpice userSpice · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 May 2026 · Tags: CWE-204 - [AVideo CVE-2026-43881 incomplete fix - \`objects/mention.json.php:17\` is an unauthenticated user enumeration sibling that survives \`d9cdc7024\`](https://agentprime.io/advisories/GHSA-vpfx-pxqw-2w79.md) `GHSA-vpfx-pxqw-2w79`, `CVE-2026-45620`, `PKSA-23zk-pg8x-sksb` · Packagist `WWBN/AVideo`: affected `<=29.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 18 May 2026 · Tags: Broken access control, CWE-204 - [Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery](https://agentprime.io/advisories/CVE-2024-0391.md) `CVE-2024-0391` · CVE record: WSO2 WSO2 Identity Server and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: CWE-204 - [Industrial Application Software IAS Canias ERP Login RMI doAction response discrepancy](https://agentprime.io/advisories/CVE-2026-8242.md) `CVE-2026-8242` · CVE record: Industrial Application Software IAS Canias ERP · CVSS 6.3 Medium · Not analysed yet · Published 10 May 2026 · Tags: Information disclosure, CWE-204 - [Lemmy resend-verification endpoint exposes registered email addresses to unauthenticated users](https://agentprime.io/advisories/GHSA-qxrw-f6fh-34r7.md) `GHSA-qxrw-f6fh-34r7` · crates.io `lemmy_api`: affected `<=0.19.1-rc.1`, no fixed version yet · CVSS 4.0, no score published · Not analysed yet · Published 6 May 2026 · Tags: CWE-204 - [Statamic CMS vulnerable to email enumeration via forgot password endpoint](https://agentprime.io/advisories/GHSA-m24v-f7g5-gq67.md) `GHSA-m24v-f7g5-gq67`, `CVE-2026-44306`, `PKSA-ynr1-y6st-8cwm` · Packagist `statamic/cms`: affected `<5.73.21 || >=6.0.0, <6.15.0`, fixed in `5.73.21`, `6.15.0` · CVSS 5.3 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-204 - [Cisco Identity Services Engine Observable Response Discrepancy Vulnerability](https://agentprime.io/advisories/CVE-2026-20195.md) `CVE-2026-20195` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 5.3 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-204 - [Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client).](https://agentprime.io/advisories/CVE-2026-34319.md) `CVE-2026-34319` · CVE record: Oracle Corporation MySQL Shell · CVSS 5.0 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-204 - [OpenAEV Vulnerable to Username/Email Enumeration Through Differential HTTP Responses in Password Reset API](https://agentprime.io/advisories/CVE-2026-24468.md) `CVE-2026-24468` · CVE record: OpenAEV-Platform openaev · CVSS 5.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: CWE-204 - [ChurchCRM: Username Enumeration via Differential Response in Public Login API](https://agentprime.io/advisories/CVE-2026-40485.md) `CVE-2026-40485` · CVE record: ChurchCRM CRM · CVSS 5.3 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Authentication bypass, CWE-204 - [Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA](https://agentprime.io/advisories/CVE-2026-34264.md) `CVE-2026-34264` · CVE record: SAP_SE SAP Human Capital Management for SAP S/4HANA · CVSS 6.5 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-204 - [SonicWall SMA1000: An observable response discrepancy vulnerability in the SonicWall SMA1000 series…](https://agentprime.io/advisories/CVE-2026-4113.md) `CVE-2026-4113` · CVE record: SonicWall SMA1000 · CVSS 7.2 High · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-204 - [Saleor has a user enumeration vulnerability due to different error messages](https://agentprime.io/advisories/CVE-2026-39851.md) `CVE-2026-39851` · CVE record: saleor saleor · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-204 - [The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000.](https://agentprime.io/advisories/CVE-2025-67807.md) `CVE-2025-67807` · CVE record · CVSS 4.7 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-204 - [The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000.](https://agentprime.io/advisories/CVE-2025-67806.md) `CVE-2025-67806` · CVE record · CVSS 3.7 Low · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-204 - [User enumeration in ESET Protect (on-prem)](https://agentprime.io/advisories/CVE-2025-3716.md) `CVE-2025-3716` · CVE record: ESET, spol. s.r.o ESET Protect (on-prem) · CVSS 5.3 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: CWE-204 - [AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint](https://agentprime.io/advisories/GHSA-m99f-mmvg-3xmx.md) `GHSA-m99f-mmvg-3xmx`, `CVE-2026-33688`, `PKSA-rmrd-1jny-519s` · Packagist `wwbn/avideo`: affected `<=26.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-204 - [MinIO LDAP login brute-force via user enumeration and missing rate limit](https://agentprime.io/advisories/GHSA-jv87-32hw-hh99.md) `GHSA-jv87-32hw-hh99`, `CVE-2026-33419`, `GO-2026-4803` · Go `github.com/minio/minio`: affected `<=0.0.0-20260212201848-7aac2a2c5b7c`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2026 · Tags: Authentication bypass, CWE-204 - [Parse Server email verification resend page leaks user existence](https://agentprime.io/advisories/GHSA-h29g-q5c2-9h4f.md) `GHSA-h29g-q5c2-9h4f`, `BIT-parse-2026-33323`, `CVE-2026-33323` · npm `parse-server`: affected `<8.6.51 || >=9.0.0, <9.6.0-alpha.40`, fixed in `8.6.51`, `9.6.0-alpha.40` · CVSS 6.3 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: CWE-204 - [Chamilo LMS: User enumeration vulnerability via response](https://agentprime.io/advisories/CVE-2026-30876.md) `CVE-2026-30876` · CVE record: chamilo chamilo-lms · CVSS 6.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-204 - [User enumeration in Raytha CMS](https://agentprime.io/advisories/CVE-2025-69243.md) `CVE-2025-69243` · CVE record: Raytha Raytha · CVSS 6.9 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-204 - [IBM Aspera Console Information Disclosure](https://agentprime.io/advisories/CVE-2025-13460.md) `CVE-2025-13460` · CVE record: IBM Aspera Console · CVSS 5.3 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-204 - [Username Enumeration Observable Response Discrepancy vulnerability has been discovered in OpenText™ Vertica.](https://agentprime.io/advisories/CVE-2025-12455.md) `CVE-2025-12455` · CVE record: OpenText™ Vertica · CVSS 5.1 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-204 - [Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint](https://agentprime.io/advisories/CVE-2026-2859.md) `CVE-2026-2859` · CVE record: Checkmk GmbH Checkmk · CVSS 6.3 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-204 - [Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint](https://agentprime.io/advisories/CVE-2026-24097.md) `CVE-2026-24097` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-204 - [projectsend Auth.php response discrepancy](https://agentprime.io/advisories/CVE-2026-4045.md) `CVE-2026-4045` · CVE record: projectsend · CVSS 6.3 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Information disclosure, CWE-204 - [Shopware has user enumeration via distinct error codes on Store API login endpoint](https://agentprime.io/advisories/GHSA-gqc5-xv7m-gcjq.md) `GHSA-gqc5-xv7m-gcjq`, `CVE-2026-31888`, `PKSA-8zg6-v85t-wcz3`, `PKSA-cck7-yytv-pqc6` · Packagist `shopware/core` and 1 more: affected `<6.6.10.15 || >=6.7.0.0, <6.7.8.1`, fixed in `6.6.10.15`, `6.7.8.1` · CVSS 5.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-204 - [Parse Server vulnerable to user enumeration via email verification endpoint](https://agentprime.io/advisories/GHSA-w54v-hf9p-8856.md) `GHSA-w54v-hf9p-8856`, `BIT-parse-2026-31901`, `CVE-2026-31901` · npm `parse-server`: affected `<8.6.34 || >=9.0.0-alpha.1, <9.6.0-alpha.8`, fixed in `8.6.34`, `9.6.0-alpha.8` · CVSS 6.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-204 - [NocoDB Vulnerable to User Enumeration via Password Reset Endpoint](https://agentprime.io/advisories/GHSA-387m-j3p9-3php.md) `GHSA-387m-j3p9-3php`, `CVE-2026-28358` · npm `nocodb`: affected `<0.301.3`, fixed in `0.301.3` · CVSS 2.7 Low · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-204 - [Dify has a user enumeration issue](https://agentprime.io/advisories/CVE-2026-28288.md) `CVE-2026-28288` · CVE record: langgenius dify · CVSS 5.5 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: CWE-204 - [Rucio WebUI has Username Enumeration via Login Error Message](https://agentprime.io/advisories/GHSA-38wq-6q2w-hcf9.md) `GHSA-38wq-6q2w-hcf9`, `CVE-2026-25138`, `PYSEC-2026-3053` · PyPI `rucio-webui`: affected `<35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1`, fixed in `35.8.3`, `38.5.4`, `39.3.1` · CVSS 5.3 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-204 - [Piwigo Vulnerable to User Enumeration via Password Reset Endpoint](https://agentprime.io/advisories/CVE-2025-62512.md) `CVE-2025-62512` · CVE record: Piwigo Piwigo · CVSS 5.5 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-204 - [Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames](https://agentprime.io/advisories/GHSA-qhp6-635j-x7r2.md) `GHSA-qhp6-635j-x7r2`, `CVE-2026-27480` · crates.io `static-web-server`: affected `>=2.1.0, <2.41.0`, fixed in `2.41.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Feb 2026 · Tags: CWE-204 - [A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint.](https://agentprime.io/advisories/CVE-2026-26744.md) `CVE-2026-26744` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: CWE-204 - [DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. Attackers can submit different username...](https://agentprime.io/advisories/PYSEC-2026-57.md) `PYSEC-2026-57`, `CVE-2019-25338` · PyPI `dokuwiki`: affected , no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 12 Feb 2026 · Tags: CWE-204 - [Open eClass is Vulnerable to Username Enumeration via Login Response Discrepancies](https://agentprime.io/advisories/CVE-2026-24664.md) `CVE-2026-24664` · CVE record: gunet openeclass · CVSS 5.3 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: CWE-204 - [CI4MS Vulnerable to User Email Enumeration via Password Reset Flow](https://agentprime.io/advisories/GHSA-654x-9q7r-g966.md) `GHSA-654x-9q7r-g966`, `CVE-2026-25509`, `PKSA-72bz-jm9q-1sgn` · Packagist `ci4-cms-erp/ci4ms`: affected `<0.28.5.0`, fixed in `0.28.5.0` · CVSS 5.3 Medium · Not analysed yet · Published 2 Feb 2026 · Tags: Information disclosure, CWE-204 - [Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user i…](https://agentprime.io/advisories/CVE-2026-24332.md) `CVE-2026-24332` · CVE record: Discord WebSocket API service · CVSS 4.3 Medium · Not analysed yet · Published 22 Jan 2026 · Tags: CWE-204 - [Zitadel has a user enumeration vulnerability in Login UIs](https://agentprime.io/advisories/GHSA-pvm5-9frx-264r.md) `GHSA-pvm5-9frx-264r`, `CVE-2026-23511`, `GO-2026-4319` · Go `github.com/zitadel/zitadel`: affected `<3.4.6 || >=4.0.0, <4.9.1`, fixed in `3.4.6`, `4.9.1` · CVSS 5.3 Medium · Not analysed yet · Published 15 Jan 2026 · Tags: Information disclosure, CWE-204 - [Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea](https://agentprime.io/advisories/GHSA-pc73-rj2c-wvf9.md) `GHSA-pc73-rj2c-wvf9`, `BIT-gitea-2025-69413`, `CVE-2025-69413`, `GO-2026-4274` · Go `code.gitea.io/gitea`: affected `<1.25.2`, fixed in `1.25.2` · CVSS 5.3 Medium · Not analysed yet · Published 12 Jan 2026 · Tags: CWE-204 - [AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery](https://agentprime.io/advisories/CVE-2026-21484.md) `CVE-2026-21484` · CVE record: Mintplex-Labs anything-llm · CVSS 5.3 Medium · Not analysed yet · Published 3 Jan 2026 · Tags: Information disclosure, CWE-204 - [ChurchCRM has plaintext password return in response](https://agentprime.io/advisories/CVE-2025-67874.md) `CVE-2025-67874` · CVE record: ChurchCRM CRM · CVSS 6.9 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: CWE-204 - [Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated us…](https://agentprime.io/advisories/CVE-2025-62181.md) `CVE-2025-62181` · CVE record: Pegasystems Pega Infinity · CVSS 5.3 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: CWE-204 - [Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration](https://agentprime.io/advisories/CVE-2025-67500.md) `CVE-2025-67500` · CVE record: mastodon mastodon · CVSS 3.7 Low · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-204 - [IntelliChoice eFORCE Software Suite Username Enumeration](https://agentprime.io/advisories/CVE-2021-47717.md) `CVE-2021-47717` · CVE record: IntelliChoice IntelliChoice eFORCE Software Suite · CVSS 6.9 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-204 - [A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1).](https://agentprime.io/advisories/CVE-2025-40806.md) `CVE-2025-40806` · CVE record: Siemens Gridscale X Prepay · CVSS 6.9 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-204 - [Medtronic CareLink Network: Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a…](https://agentprime.io/advisories/CVE-2025-12994.md) `CVE-2025-12994` · CVE record: Medtronic CareLink Network · CVSS 5.3 Medium · Not analysed yet · Published 4 Dec 2025 · Tags: CWE-204 - [Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism.](https://agentprime.io/advisories/CVE-2025-65899.md) `CVE-2025-65899` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 4 Dec 2025 · Tags: CWE-204 - [Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure](https://agentprime.io/advisories/GHSA-q3qx-cp62-f6m7.md) `GHSA-q3qx-cp62-f6m7`, `CVE-2025-66307`, `PKSA-kdts-d57h-cyfm` · Packagist `getgrav/grav`: affected `<1.8.0-beta.27`, fixed in `1.8.0-beta.27` · CVSS 6.5 Medium · Not analysed yet · Published 2 Dec 2025 · Tags: CWE-204 - [User enumeration in Windu CMS](https://agentprime.io/advisories/CVE-2025-59116.md) `CVE-2025-59116` · CVE record: JCD Windu CMS · CVSS 6.9 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: CWE-204 - [Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability.](https://agentprime.io/advisories/CVE-2025-25236.md) `CVE-2025-25236` · CVE record: Omnissa Omnissa Workspace ONE UEM · CVSS 5.3 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: CWE-204 - [Frontier Airlines publicly available email address validation](https://agentprime.io/advisories/CVE-2025-62236.md) `CVE-2025-62236` · CVE record: Frontier Airlines flyfrontier.com · CVSS 6.9 Medium · Not analysed yet · Published 23 Oct 2025 · Tags: CWE-204 - [Tibbo AggreGate Network Manager < 6.40.05 Login Functionality User Enumeration](https://agentprime.io/advisories/CVE-2025-34155.md) `CVE-2025-34155` · CVE record: Tibbo Systems AggreGate Network Manager · CVSS 6.9 Medium · Not analysed yet · Published 23 Oct 2025 · Tags: CWE-204 - [D-Link Nuclias Connect <= v1.3.1.4 Forgot Password Account Enumeration](https://agentprime.io/advisories/CVE-2025-34255.md) `CVE-2025-34255` · CVE record: D-Link Nuclias Connect · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: CWE-204 - [D-Link Nuclias Connect <= v1.3.1.4 Login Account Enumeration](https://agentprime.io/advisories/CVE-2025-34254.md) `CVE-2025-34254` · CVE record: D-Link Nuclias Connect · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: CWE-204 - [Icinga 2 API users could access restricted values in filter expressions](https://agentprime.io/advisories/CVE-2025-61907.md) `CVE-2025-61907` · CVE record: Icinga icinga2 · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2025 · Tags: Information disclosure, CWE-204, CWE-749 - [Icinga DB Web hidden/protected custom variables are prone to filter enumeration](https://agentprime.io/advisories/CVE-2025-61789.md) `CVE-2025-61789` · CVE record: Icinga icingadb-web · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: CWE-204 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .