agentprime: CWE-204

CVE-2026-100362: SuiteCRM: V8 OAuth2 Username Enumeration

Thu, 05 Nov 2026 18:44:59 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85286: HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay

Thu, 05 Nov 2026 16:01:52 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-97702: Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce

Wed, 04 Nov 2026 22:51:25 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-122139: blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset

Wed, 04 Nov 2026 20:36:56 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-119700: WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations

Fri, 30 Oct 2026 15:16:01 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-100164: User Enumeration in Rolantis Information Technologies' Agentis

Tue, 27 Oct 2026 12:03:27 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-49442: Cacti: User Enumeration via Error Messages

Fri, 23 Oct 2026 14:45:13 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-7478: Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery

Wed, 21 Oct 2026 13:49:07 GMT

CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-111056: FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint

Mon, 19 Oct 2026 16:00:57 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-111887: phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint

Sat, 17 Oct 2026 18:46:12 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-105664: Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy

Fri, 16 Oct 2026 14:06:55 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-14177: User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure

Fri, 16 Oct 2026 08:13:48 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-111386: Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig

Fri, 16 Oct 2026 01:17:54 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-111235: OpenNMS REST authorization bypass via non-canonical HTTP method

Thu, 15 Oct 2026 18:45:06 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-110310: RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET

Wed, 14 Oct 2026 19:37:48 GMT

CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-103526: CVE-2026-103526

Mon, 12 Oct 2026 14:54:35 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-109206: LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet

Mon, 12 Oct 2026 13:39:47 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Contao: The registration module re-sends activation mails

Fri, 09 Oct 2026 20:54:04 GMT

contao/core-bundle >=4.1.0, <5.3.50 || >=5.4.0-RC1, <5.7.12, fixed in 5.3.50, 5.7.12. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-59785: Hidden host credentials inferable via multiselect.get filtering

Mon, 05 Oct 2026 10:28:30 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

Fri, 02 Oct 2026 23:05:33 GMT

github.com/siyuan-note/siyuan/kernel <0.0.0-20260804015139-bd067a4fe9b2, fixed in 0.0.0-20260804015139-bd067a4fe9b2. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-82043: UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint

Fri, 02 Oct 2026 20:17:20 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-104439: YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

Fri, 02 Oct 2026 11:38:15 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-86778: Username Enumeration in Maksisoft Technology's Maksisoft Gym

Wed, 30 Sep 2026 12:59:32 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102587: Moodle: user list filters bypass profile field visibility

Wed, 30 Sep 2026 08:36:21 GMT

CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-84717: Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates

Wed, 23 Sep 2026 19:40:32 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-71462: Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod

Wed, 23 Sep 2026 18:25:22 GMT

CVSS 4.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-71458: Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration

Wed, 23 Sep 2026 18:07:58 GMT

CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-89173: Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure

Fri, 11 Sep 2026 07:27:52 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-9161: User Enumeration in DernekPlus' Website Template

Thu, 10 Sep 2026 12:06:25 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-86758: Snipe-IT before 8.7.0 License Key Exposure via CSV Export

Wed, 09 Sep 2026 13:32:18 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-19205: User Enumeration in GastroMenum's GastroMenum Web Panel

Fri, 04 Sep 2026 14:08:37 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-19080: Username Enumeration in Menulux Software's Menulux Portal

Fri, 04 Sep 2026 11:56:51 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-78584: Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

Wed, 02 Sep 2026 14:43:22 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Filament: Password validity disclosure for accounts denied panel access on login page

Tue, 01 Sep 2026 21:29:00 GMT

filament/filament >=4.0.0, <4.12.5 || >=5.0.0, <5.7.5, fixed in 4.12.5, 5.7.5. CVSS 3.7 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-81033: Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

Wed, 26 Aug 2026 15:45:00 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-75575: Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method

Tue, 25 Aug 2026 01:30:29 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-27462: Combodo iTop: User enumeration via password reset

Fri, 21 Aug 2026 19:52:04 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-69519: Azure Stack HCI Information Disclosure Vulnerability

Thu, 20 Aug 2026 21:43:11 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Thu, 20 Aug 2026 18:34:21 GMT

github.com/coder/coder/v2 <2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2, fixed in 2.29.17, 2.32.7, 2.33.8, 2.34.2. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-66002: Frappe: User Enumeration via PDDR

Thu, 20 Aug 2026 18:29:40 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-54739: Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential

Wed, 19 Aug 2026 20:16:01 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-19965: automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy

Mon, 17 Aug 2026 00:00:14 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-14672: PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle

Thu, 13 Aug 2026 13:00:06 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-72588: bluewave-labs Checkmate - User Enumeration via Differential HTTP Response in Password Recovery

Mon, 10 Aug 2026 10:41:39 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-55998: Cluster Existence Oracle via Unauthenticated Import Endpoint

Wed, 05 Aug 2026 07:51:21 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Ghost: Member existence leak via magic link sign-in response

Tue, 04 Aug 2026 21:56:13 GMT

ghost >=5.18.0, <6.21.2, fixed in 6.21.2. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-60007: Eclipse Foundation Eclipse Milo: In Eclipse Milo versions 0.6.0 through 1.1.4…

Tue, 04 Aug 2026 11:55:41 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-14202: Username Enumeration via Differential Login Responses in Bilin Software's HUMANIST Digital Human Resources

Tue, 04 Aug 2026 09:07:15 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Fri, 31 Jul 2026 22:24:29 GMT

wp-graphql/wp-graphql <=2.6.0, no fixed version yet. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Budibase: Account Enumeration via Login Lockout Response Differential

Fri, 24 Jul 2026 21:43:11 GMT

@budibase/server <=3.38.1, no fixed version yet. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.