# CWE-208.

Every Advisory and CVE whose sources give the weakness CWE-208, newest first.

## Records, newest first (an older page)

- [389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification](https://agentprime.io/advisories/CVE-2026-15041.md)
  `CVE-2026-15041` · CVE record: Red Hat Red Hat Directory Server 11 and 4 more · CVSS 3.7 Low · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-208
- [OP-TEE: Hisilicon HPRE PKCS#1 v1.5 Decryption Padding Oracle](https://agentprime.io/advisories/CVE-2026-41516.md)
  `CVE-2026-41516` · CVE record: OP-TEE optee_os · CVSS 2.5 Low · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-208
- [OP-TEE: RSA-OAEP padding oracle in NXP CAAM driver enables plaintext recovery](https://agentprime.io/advisories/CVE-2026-41515.md)
  `CVE-2026-41515` · CVE record: OP-TEE optee_os · CVSS 2.5 Low · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-208
- [OP-TEE: RSA-OAEP padding oracle in Hisilicon HPRE driver enables plaintext recovery](https://agentprime.io/advisories/CVE-2026-41514.md)
  `CVE-2026-41514` · CVE record: OP-TEE optee_os · CVSS 2.5 Low · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-208
- [pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier](https://agentprime.io/advisories/GHSA-mjgf-xj26-9qf9.md)
  `GHSA-mjgf-xj26-9qf9`, `CVE-2026-70658` · RubyGems `pay`: affected `<=11.6.1`, no fixed version yet · CVSS 7.4 High · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-208
- [Coolify: Timing Attack in GitLab Webhook Token Validation](https://agentprime.io/advisories/CVE-2026-27882.md)
  `CVE-2026-27882` · CVE record: coollabsio coolify · CVSS 4.8 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-208
- [CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path](https://agentprime.io/advisories/CVE-2026-13758.md)
  `CVE-2026-13758` · CVE record: MIK CryptX · CVSS 3.7 Low · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-208
- [An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, allowing the input of an arbitrary message,…](https://agentprime.io/advisories/CVE-2023-20572.md)
  `CVE-2023-20572` · CVE record: AMD AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics and 4 more · CVSS 5.6 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-208
- [An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, allowing arbitrary message input, potential…](https://agentprime.io/advisories/CVE-2023-20540.md)
  `CVE-2023-20540` · CVE record: AMD AMD Ryzen™ 3000 Series Desktop Processors and 4 more · CVSS 1.8 Low · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-208
- [Authenticate method auth bypass in github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension](https://agentprime.io/advisories/GHSA-pjv4-3c63-699f.md)
  `GHSA-pjv4-3c63-699f`, `CVE-2026-42602`, `GO-2026-5544` · Go `github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension`: affected `>=0.124.0, <0.151.0`, fixed in `0.151.0` · CVSS 8.1 High · Not analysed yet · Published 25 Jun 2026 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-208
- [Bleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryption](https://agentprime.io/advisories/CVE-2026-6291.md)
  `CVE-2026-6291` · CVE record: wolfSSL wolfSSL · CVSS 6.0 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-208
- [Filament: Timing-based user enumeration on login page](https://agentprime.io/advisories/GHSA-5w46-g9pq-wh6f.md)
  `GHSA-5w46-g9pq-wh6f`, `CVE-2026-48166`, `PKSA-3rh1-zh9g-4mq5` · Packagist `filament/filament`: affected `>=4.0.0, <4.11.5 || >=5.0.0, <5.6.5`, fixed in `4.11.5`, `5.6.5` · CVSS 5.3 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: CWE-208
- [PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle](https://agentprime.io/advisories/GHSA-5739-39v2-5754.md)
  `GHSA-5739-39v2-5754` · Packagist `web-token/jwt-library`: affected `<3.4.10 || >=4.0.0, <4.0.7 || >=4.1.0, <4.1.7`, fixed in `3.4.10`, `4.0.7`, `4.1.7` · CVSS 4.0, no score published · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-208, CWE-385
- [Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison](https://agentprime.io/advisories/CVE-2026-54411.md)
  `CVE-2026-54411` · CVE record: Linux-PAM Linux-PAM · CVSS 6.9 Medium · Not analysed yet · Published 14 Jun 2026 · Tags: CWE-208
- [Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks](https://agentprime.io/advisories/CVE-2017-20240.md)
  `CVE-2017-20240` · CVE record: ARODLAND Crypt::PBKDF2 · CVSS 5.9 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-208
- [SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration](https://agentprime.io/advisories/CVE-2026-48859.md)
  `CVE-2026-48859` · CVE record: Erlang OTP · CVSS 6.3 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: CWE-208
- [NocoDB: User Enumeration via Sign-In Timing](https://agentprime.io/advisories/GHSA-jr54-jwhj-55gp.md)
  `GHSA-jr54-jwhj-55gp`, `CVE-2026-47380` · npm `nocodb`: affected `<2026.04.1`, fixed in `2026.04.1` · CVSS 6.3 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: Authentication bypass, CWE-208
- [Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames](https://agentprime.io/advisories/GHSA-7w52-7jvm-m9vw.md)
  `GHSA-7w52-7jvm-m9vw`, `CVE-2026-48011`, `PKSA-xwkj-rryn-xz6v`, `PKSA-yt77-qm1k-2vvb` · Packagist `shopware/core` and 1 more: affected `<6.6.10.18 || >=6.7.0.0, <6.7.10.1`, fixed in `6.6.10.18`, `6.7.10.1` · CVSS 3.7 Low · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-208
- [Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal](https://agentprime.io/advisories/CVE-2026-5419.md)
  `CVE-2026-5419` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 3.7 Low · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-208
- [Time-based user enumeration in TREK authentication endpoint](https://agentprime.io/advisories/CVE-2026-45410.md)
  `CVE-2026-45410` · CVE record: mauriceboe TREK · CVSS 5.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: Information disclosure, CWE-208
- [Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks](https://agentprime.io/advisories/CVE-2026-5091.md)
  `CVE-2026-5091` · CVE record: JJNAPIORK Catalyst::Plugin::Authentication · CVSS 5.1 Medium · Not analysed yet · Published 21 May 2026 · Tags: CWE-208
- [DES-ECB auth with timing side channel](https://agentprime.io/advisories/CVE-2026-44061.md)
  `CVE-2026-44061` · CVE record: Netatalk Netatalk · CVSS 5.9 Medium · Not analysed yet · Published 21 May 2026 · Tags: CWE-208
- [Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks](https://agentprime.io/advisories/CVE-2026-47373.md)
  `CVE-2026-47373` · CVE record: RRWO Crypt::SaltedHash · CVSS 7.5 High · Not analysed yet · Published 20 May 2026 · Tags: CWE-208
- [memcached: In memcached before 1.6.42, password data for SASL password database authentication has a…](https://agentprime.io/advisories/CVE-2026-47784.md)
  `CVE-2026-47784` · CVE record: memcached memcached · CVSS 8.1 High · Not analysed yet · Published 20 May 2026 · Tags: CWE-208
- [memcached: In memcached before 1.6.42, username data for SASL password database authentication has a…](https://agentprime.io/advisories/CVE-2026-47783.md)
  `CVE-2026-47783` · CVE record: memcached memcached · CVSS 8.1 High · Not analysed yet · Published 20 May 2026 · Tags: CWE-208
- [Apache Tomcat - AJP secret compared in non-constant time](https://agentprime.io/advisories/GHSA-9m89-8frq-c98c.md)
  `GHSA-9m89-8frq-c98c`, `BIT-tomcat-2026-43514`, `CVE-2026-43514` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `<9.0.118 || >=10.1.0-M1, <10.1.55 || >=11.0.0-M1, <11.0.22`, fixed in `9.0.118`, `10.1.55`, `11.0.22` · CVSS 3.7 Low · Not analysed yet · Published 12 May 2026 · Tags: CWE-208
- [RELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key()](https://agentprime.io/advisories/CVE-2026-41588.md)
  `CVE-2026-41588` · CVE record: inducer relate · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2026 · Tags: CWE-208
- [net/tcp-md5: Fix MAC comparison to be constant-time](https://agentprime.io/advisories/CVE-2026-43383.md)
  `CVE-2026-43383` · CVE record: Linux Linux · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2026 · Tags: CWE-208
- [mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening](https://agentprime.io/advisories/GHSA-j7h9-2jh7-g967.md)
  `GHSA-j7h9-2jh7-g967` · npm `mcp-ssh-tool`: affected `<2.1.1`, fixed in `2.1.1` · CVSS 4.0, no score published · Not analysed yet · Published 7 May 2026 · Tags: Path traversal, CWE-208
- [Kanidm has non-constant-time comparison of OAuth2 client_secret](https://agentprime.io/advisories/GHSA-53hj-r94p-8c8f.md)
  `GHSA-53hj-r94p-8c8f` · crates.io `kanidm`: affected `<1.9.3`, fixed in `1.9.3` · CVSS 3.7 Low · Not analysed yet · Published 6 May 2026 · Tags: CWE-208
- [Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening](https://agentprime.io/advisories/GHSA-9h64-2846-7x7f.md)
  `GHSA-9h64-2846-7x7f`, `GO-2026-5290` · Go `github.com/getaxonflow/axonflow`: affected `<7.5.0`, fixed in `7.5.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 May 2026 · Tags: SQL injection, Information disclosure, Denial of service, Broken access control
- [pyquorum: Timing side‑channel in mul_mod](https://agentprime.io/advisories/GHSA-7r92-3jgr-r65q.md)
  `GHSA-7r92-3jgr-r65q`, `CVE-2026-44368`, `PYSEC-2026-3028` · PyPI `pyquorum`: affected `<0.2.1`, fixed in `0.2.1` · CVSS 6.9 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-208
- [Apache HTTP Server: mod_auth_digest timing attack](https://agentprime.io/advisories/CVE-2026-33006.md)
  `CVE-2026-33006` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 4.8 Medium · Not analysed yet · Published 4 May 2026 · Tags: CWE-208
- [Spring Boot DevTools remote secret comparison is vulnerable to timing attacks](https://agentprime.io/advisories/GHSA-56v8-86gj-66jp.md)
  `GHSA-56v8-86gj-66jp`, `CVE-2026-40972` · Maven `org.springframework.boot:spring-boot-devtools`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32`, fixed in `4.0.6`, `3.5.14` · CVSS 7.5 High · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-208
- [Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware](https://agentprime.io/advisories/GHSA-6x2q-h3cr-8j2h.md)
  `GHSA-6x2q-h3cr-8j2h`, `CVE-2026-41263`, `GO-2026-5195` · Go `github.com/traefik/traefik` and 2 more: affected `<=1.7.34`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-208
- [4ga Boards: User Enumeration via Timing Side-Channel in Authentication Endpoint](https://agentprime.io/advisories/CVE-2026-41418.md)
  `CVE-2026-41418` · CVE record: RARgames 4gaBoards · CVSS 5.3 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-208
- [Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider](https://agentprime.io/advisories/GHSA-vxf7-qj7q-83fh.md)
  `GHSA-vxf7-qj7q-83fh`, `CVE-2026-22746` · Maven `org.springframework.security:spring-security-core`: affected `>=5.7.0, <=5.7.22 || >=5.8.0, <=5.8.24 || >=6.3.0, <=6.3.15 || >=6.4.0, <=6.4.15 || >=6.5.0, <6.5.10 || >=7.0.0, <7.0.5`, fixed in `6.5.10`, `7.0.5` · CVSS 3.7 Low · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-208
- [Kimai: Username enumeration via timing on X-AUTH-USER](https://agentprime.io/advisories/GHSA-jrc6-fmhw-fpq2.md)
  `GHSA-jrc6-fmhw-fpq2`, `CVE-2026-80199`, `PKSA-v9zg-kkkv-rs7x` · Packagist `kimai/kimai`: affected `<2.54.0`, fixed in `2.54.0` · CVSS 6.3 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-208
- [Mojic: Observable Timing Discrepancy in HMAC Verification](https://agentprime.io/advisories/GHSA-wqq3-wfmp-v85g.md)
  `GHSA-wqq3-wfmp-v85g`, `CVE-2026-41244` · npm `mojic`: affected `<2.1.4`, fixed in `2.1.4` · CVSS 4.7 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-208
- [ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint](https://agentprime.io/advisories/GHSA-mj7r-x3h3-7rmr.md)
  `GHSA-mj7r-x3h3-7rmr`, `CVE-2026-33877` · npm `apostrophe`: affected `<4.29.0`, fixed in `4.29.0` · CVSS 3.7 Low · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-208
- [Sync-in Server has Username Enumeration via Timing Attack](https://agentprime.io/advisories/GHSA-43fj-qp3h-hrh5.md)
  `GHSA-43fj-qp3h-hrh5`, `CVE-2026-41161` · npm `@sync-in/server`: affected `<2.2.0`, fixed in `2.2.0` · CVSS 6.9 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: CWE-208
- [Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks](https://agentprime.io/advisories/CVE-2026-5086.md)
  `CVE-2026-5086` · CVE record: NERDVANA Crypt::SecretBuffer · CVSS 7.5 High · Not analysed yet · Published 13 Apr 2026 · Tags: CWE-208
- [Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel](https://agentprime.io/advisories/GHSA-w6m9-39cv-2fwp.md)
  `GHSA-w6m9-39cv-2fwp`, `CVE-2026-40263`, `GO-2026-5696` · Go `github.com/enchant97/note-mark/backend`: affected `<0.19.2-0.20260411145025-cf4c6f6acf70`, fixed in `0.19.2-0.20260411145025-cf4c6f6acf70` · CVSS 3.7 Low · Not analysed yet · Published 13 Apr 2026 · Tags: CWE-208
- [phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()](https://agentprime.io/advisories/GHSA-r854-jrxh-36qx.md)
  `GHSA-r854-jrxh-36qx`, `CVE-2026-40194`, `PKSA-zh4j-by9m-7mz8` · Packagist `phpseclib/phpseclib`: affected `>=0.1.1, <1.0.28 || >=2.0.0, <2.0.53 || >=3.0.0, <3.0.51`, fixed in `1.0.28`, `2.0.53`, `3.0.51` · CVSS 3.7 Low · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-208
- [Parse Server has a login timing side-channel reveals user existence](https://agentprime.io/advisories/GHSA-mmpq-5hcv-hf2v.md)
  `GHSA-mmpq-5hcv-hf2v`, `BIT-parse-2026-39321`, `CVE-2026-39321` · npm `parse-server`: affected `<8.6.74 || >=9.0.0, <9.8.0-alpha.6`, fixed in `8.6.74`, `9.8.0-alpha.6` · CVSS 6.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-208
- [OpenClaw: Shared-secret comparison call sites leaked length information through timing](https://agentprime.io/advisories/GHSA-jj6q-rrrf-h66h.md)
  `GHSA-jj6q-rrrf-h66h`, `CVE-2026-41407` · npm `openclaw`: affected `<2026.4.2`, fixed in `2026.4.2` · CVSS 6.3 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-208
- [node: A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating…](https://agentprime.io/advisories/CVE-2026-21713.md)
  `CVE-2026-21713` · CVE record: nodejs node · CVSS 5.9 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: CWE-208
- [Improper authentication in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-27856.md)
  `CVE-2026-27856` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 7.4 High · Not analysed yet · Published 27 Mar 2026 · Tags: Authentication bypass, CWE-208
- [FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel](https://agentprime.io/advisories/GHSA-7789-65hx-f26w.md)
  `GHSA-7789-65hx-f26w`, `CVE-2026-54685`, `GO-2026-4820` · Go `github.com/gtsteffaniak/filebrowser/backend`: affected `<0.0.0-20260317230626-af08800667b8`, fixed in `0.0.0-20260317230626-af08800667b8` · CVSS 5.3 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-208
- [Traefik Affected by BasicAuth Middleware Timing Attack Allows Username Enumeration](https://agentprime.io/advisories/GHSA-g3hg-j4jv-cwfr.md)
  `GHSA-g3hg-j4jv-cwfr`, `CVE-2026-32595`, `GO-2026-4792` · Go `github.com/traefik/traefik` and 2 more: affected `<=1.7.34`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-208
- [phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack](https://agentprime.io/advisories/GHSA-94g3-g5v7-q4jg.md)
  `GHSA-94g3-g5v7-q4jg`, `CVE-2026-32935`, `PKSA-km2b-zc3b-mjm3` · Packagist `phpseclib/phpseclib`: affected `>=0.1.1, <1.0.27 || >=2.0.0, <2.0.52 || >=3.0.0, <3.0.50`, fixed in `1.0.27`, `2.0.52`, `3.0.50` · CVSS 8.2 High · Not analysed yet · Published 19 Mar 2026 · Tags: CWE-208
- [h3 has an observable timing discrepancy in basic auth utils](https://agentprime.io/advisories/GHSA-26f5-8h2x-34xh.md)
  `GHSA-26f5-8h2x-34xh`, `CVE-2026-33129` · npm `h3`: affected `>=2.0.0-beta.0, <2.0.1-rc.9`, fixed in `2.0.1-rc.9` · CVSS 5.9 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: CWE-208
- [Cleanuparr has Username Enumeration via Timing Attack](https://agentprime.io/advisories/CVE-2026-32702.md)
  `CVE-2026-32702` · CVE record: Cleanuparr Cleanuparr · CVSS 6.9 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-208
- [@perfood/couch-auth has an Observable Timing Discrepancy](https://agentprime.io/advisories/GHSA-mjqr-5c55-g77h.md)
  `GHSA-mjqr-5c55-g77h`, `CVE-2025-70949` · npm `@perfood/couch-auth`: affected `<=0.26.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-208
- [AWS-LC has Timing Side-Channel in AES-CCM Tag Verification](https://agentprime.io/advisories/GHSA-65p9-r9h6-22vj.md)
  `GHSA-65p9-r9h6-22vj`, `CVE-2026-3337`, `GHSA-frmv-5gcm-jwxh`, `RUSTSEC-2026-0043`, `RUSTSEC-2026-0045` · crates.io `aws-lc-fips-sys` and 1 more: affected `>=0.13.0, <0.13.12`, fixed in `0.13.12` · CVSS 8.2 High · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-208
- [OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check](https://agentprime.io/advisories/GHSA-h656-5vcf-cm23.md)
  `GHSA-h656-5vcf-cm23` · npm `openclaw`: affected `<2026.2.24`, fixed in `2026.2.24` · No CVSS score · Not analysed yet · Published 3 Mar 2026 · Tags: Denial of service, CWE-208, CWE-406
- [OpenClaw has non-constant-time token comparison in hooks authentication](https://agentprime.io/advisories/GHSA-jmm5-fvh5-gf4p.md)
  `GHSA-jmm5-fvh5-gf4p`, `CVE-2026-28464` · npm `openclaw`: affected `<2026.2.12`, fixed in `2026.2.12` · CVSS 8.2 High · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-208
- [OpenClaw: Config writes could persist resolved ${VAR} secrets to disk](https://agentprime.io/advisories/GHSA-47q7-97xp-m272.md)
  `GHSA-47q7-97xp-m272`, `CVE-2026-28475` · npm `openclaw`: affected `<2026.2.13`, fixed in `2026.2.13` · CVSS 6.3 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-208
- [In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure.](https://agentprime.io/advisories/CVE-2025-48630.md)
  `CVE-2025-48630` · CVE record: Google Android · CVSS 7.4 High · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-208
- [OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function](https://agentprime.io/advisories/GHSA-xjhr-fm27-4hmx.md)
  `GHSA-xjhr-fm27-4hmx`, `CVE-2026-26717`, `PYSEC-2026-3052` · PyPI `richie`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 4.8 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-208

Newest: <https://agentprime.io/advisories/tag/cwe-208.md>
Older: <https://agentprime.io/advisories/tag/cwe-208.md?cursor=WyIyMDI2LTAyLTI1VDE4OjMxOjM4LjAwMDAwMFoiLCJHSFNBLXhqaHItZm0yNy00aG14Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-208&cursor=WyIyMDI2LTA3LTE0VDIxOjM2OjUyLjc3NjAwMFoiLCJDVkUtMjAyNi0yMTg0MCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-208/?cursor=WyIyMDI2LTA3LTE0VDIxOjM2OjUyLjc3NjAwMFoiLCJDVkUtMjAyNi0yMTg0MCJd>. Everything for agents: <https://agentprime.io/llms.txt>.