agentprime: CWE-208

CVE-2026-103021: OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading

Thu, 05 Nov 2026 20:06:36 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85286: HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay

Thu, 05 Nov 2026 16:01:52 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-74846: Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier

Tue, 03 Nov 2026 07:51:25 GMT

Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-63410: secp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplication

Fri, 30 Oct 2026 22:48:09 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-62860: Picsou vulnerable to login timing attack

Fri, 30 Oct 2026 20:40:46 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-93434: Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets

Tue, 27 Oct 2026 15:52:28 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose

Mon, 26 Oct 2026 19:54:07 GMT

jose >=1.10.0, <1.11.13, fixed in 1.11.13. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-87946: SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144

Thu, 22 Oct 2026 01:21:57 GMT

CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-24715: Lack of Reproducible Vulnerability Evidence in QNAP Report

Thu, 15 Oct 2026 06:58:49 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-109379: Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check

Mon, 12 Oct 2026 20:55:11 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-83535: Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison

Mon, 12 Oct 2026 18:50:25 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-107269: Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy

Wed, 07 Oct 2026 15:40:17 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-18040: HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler

Sat, 03 Oct 2026 08:55:06 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-18036: NTRU leaks private key information by reducing secret values with a non-constant-time integer division

Fri, 02 Oct 2026 07:54:16 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Tue, 29 Sep 2026 17:56:31 GMT

oauthlib >=3.0.0, <4.0.0, fixed in 4.0.0. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation

Tue, 29 Sep 2026 15:32:22 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V

Tue, 29 Sep 2026 15:32:17 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves

Tue, 29 Sep 2026 15:32:15 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-77987: GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

Tue, 22 Sep 2026 20:43:53 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Tue, 22 Sep 2026 20:40:49 GMT

github.com/traefik/traefik *, no fixed version yet. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function

Tue, 22 Sep 2026 20:40:19 GMT

lightrag-hku <1.5.5, fixed in 1.5.5. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Tinyauth: User enumeration attack by timing oracle

Tue, 22 Sep 2026 20:37:06 GMT

github.com/tinyauthapp/tinyauth <1.0.1-0.20260714134959-c22925c2fba9, fixed in 1.0.1-0.20260714134959-c22925c2fba9. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

Tue, 22 Sep 2026 20:36:51 GMT

github.com/openbao/openbao <0.0.0-20260713141742-763625a20721 || >=0.1.0, <=1.1.5, fixed in 0.0.0-20260713141742-763625a20721. CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Tue, 22 Sep 2026 14:49:23 GMT

@sync-in/server <2.4.1, fixed in 2.4.1. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-95270: dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy

Tue, 22 Sep 2026 11:15:11 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection

Thu, 17 Sep 2026 20:25:05 GMT

getgrav/grav <2.0.16, fixed in 2.0.16. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2023-24035: An issue was discovered in Nagios XI before 5.9.3.

Mon, 14 Sep 2026 00:00:00 GMT

CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-87737: An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml.

Wed, 09 Sep 2026 04:21:37 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

Tue, 08 Sep 2026 21:24:29 GMT

phpseclib/phpseclib <3.0.57 || >=4.0.0, <4.0.1, fixed in 3.0.57, 4.0.1. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-16037: Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

Tue, 08 Sep 2026 15:12:44 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-81159: Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

Wed, 02 Sep 2026 12:32:12 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-82449: Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Sat, 29 Aug 2026 12:05:35 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

Fri, 28 Aug 2026 22:26:16 GMT

github.com/free5gc/ausf <1.4.5, fixed in 1.4.5. CVSS 3.7 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

Fri, 28 Aug 2026 16:01:05 GMT

phalcon/cphalcon <5.14.1, fixed in 5.14.1. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-78500: Dimension Blind SSRF via Database Test Connection Feature

Thu, 27 Aug 2026 23:26:30 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-59276: Timing Attack via Non-Constant-Time Comparison of Sensitive Values

Thu, 27 Aug 2026 17:57:34 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-18259: Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

Tue, 25 Aug 2026 22:21:39 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

Duplicate Advisory: Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection

Tue, 25 Aug 2026 03:32:09 GMT

getgrav/grav *, no fixed version yet. CVSS 3.7 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-72700: Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison

Tue, 25 Aug 2026 01:30:22 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-53525: WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication

Fri, 21 Aug 2026 22:19:21 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-44255: Wazuh: Username Enumeration via Timing Side-Channel

Wed, 19 Aug 2026 16:15:19 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-75589: Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify

Wed, 19 Aug 2026 07:20:44 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

Mon, 17 Aug 2026 17:49:21 GMT

ep_etherpad-lite <3.3.0, fixed in 3.3.0. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-16458: Timing side-channel in RSA PKCS#1 v1.5 decryption in ocrypto

Thu, 13 Aug 2026 08:31:39 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-16459: Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA Crypto

Thu, 13 Aug 2026 08:29:07 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-43606: Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagnetic emanation attacks,…

Tue, 11 Aug 2026 16:49:12 GMT

CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-6727: CVE-2026-6727

Tue, 11 Aug 2026 15:22:18 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-49506: Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

Thu, 06 Aug 2026 14:33:12 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-16731: Authentication and authorization bypass via cryptographic timing side-channel attack in StationScout

Thu, 06 Aug 2026 13:14:25 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-16315: Authentication and authorization bypass via cryptographic timing side-channel attack in StationGuard

Thu, 06 Aug 2026 13:14:24 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.