Total
188 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-24332 | 2026-09-13 | N/A | 4.3 MEDIUM | ||
| Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with "status": "offline"), whereas offline users are omitted from the presences array. This is arguably inconsistent with the UI description of Invisible as "You will appear offline." NOTE: a third-party report suggests that this was remediated later in 2026. | |||||
| CVE-2026-89173 | 2026-09-11 | N/A | 5.3 MEDIUM | ||
| Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses. | |||||
| CVE-2026-66002 | 2026-09-10 | N/A | N/A | ||
| Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py return distinguishable response shapes for registered and unregistered email addresses, including the user_name field and persistence behavior. A remote attacker can compare the responses to enumerate registered users. This issue is fixed in versions 15.115.0 and 16.27.0. | |||||
| CVE-2026-75575 | 2026-09-10 | N/A | 5.3 MEDIUM | ||
| Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset message for any address that matches an account. With no DDPRateLimiter rule registered for it, a caller can drive an unbounded volume of reset mail at a chosen address from the deployment's own mail sender, and can probe addresses at scale: the method answers true for an address with no account and for a successful send, but false when the address belongs to an account that authenticates through an external provider and Accounts_AllowPasswordChangeForOAuthUsers is off, so repeated calls distinguish that class of account. Later versions register a rule permitting ten calls per minute per client address. | |||||
| CVE-2026-54768 | 2026-09-10 | N/A | N/A | ||
| WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1. | |||||
| CVE-2026-9161 | 2026-09-10 | N/A | 5.3 MEDIUM | ||
| Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-27462 | 2026-09-09 | N/A | 7.5 HIGH | ||
| Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3. | |||||
| CVE-2026-54739 | 2026-09-09 | N/A | N/A | ||
| Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/local_user/login.rs returns different errors depending on whether the username_or_email value exists. LocalUserView::find_by_email_or_name propagates a NotFound response for an unknown account, while an existing account with a wrong password returns LemmyErrorType::IncorrectLogin. This observable response discrepancy, including HTTP 404 for a nonexistent account and HTTP 400 for an incorrect password on an existing account, allows an unauthenticated attacker to confirm registered usernames or email addresses and use the results for targeted credential attacks or social engineering. This issue is fixed in versions 0.19.19 and 1.0.0-beta.1. | |||||
| CVE-2026-84307 | 2026-09-09 | N/A | 3.7 LOW | ||
| Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel(). For an account that canAccessPanel() denies, submitting the correct password renders the MFA challenge while an incorrect password returns the generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid for that account. When email-based MFA is configured, the correct-password path also sends a login code to the account holder. The issue applies only to accounts that have MFA enabled and are denied panel access. Authentication is not bypassed because canAccessPanel() still runs after the challenge, and no session is created. This issue is fixed in versions 4.12.5 and 5.7.5. | |||||
| CVE-2026-86758 | 2026-09-09 | N/A | 6.5 MEDIUM | ||
| Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission. | |||||
| CVE-2026-73306 | 2026-09-08 | N/A | 5.3 MEDIUM | ||
| Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25. | |||||
| CVE-2026-19205 | 2026-09-08 | N/A | 7.5 HIGH | ||
| Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: before 31.08.2026. | |||||
| CVE-2026-19080 | 2026-09-08 | N/A | 7.5 HIGH | ||
| Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting. This issue affects Menulux Portal: before 20260903211448. | |||||
| CVE-2026-78584 | 1 Elastic | 1 Kibana | 2026-09-03 | N/A | 4.3 MEDIUM |
| Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access. | |||||
| CVE-2026-55998 | 2026-09-01 | N/A | 5.3 MEDIUM | ||
| The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle. | |||||
| CVE-2026-14672 | 1 Postgresql | 1 Postgresql | 2026-08-29 | N/A | 5.3 MEDIUM |
| Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.6, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected. | |||||
| CVE-2026-81033 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account raises an error that the global handler renders as a not-found status, while a registered address proceeds to send the reset message and returns no-content. The route is mounted without authentication. Submitting candidate addresses and comparing the two status codes therefore establishes which addresses hold accounts, with no credential and no rate limiting in the path. | |||||
| CVE-2026-72588 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts. | |||||
| CVE-2026-14202 | 2026-08-26 | N/A | 5.3 MEDIUM | ||
| Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1. | |||||
| CVE-2026-69519 | 1 Microsoft | 1 Azure Stack Hci | 2026-08-25 | N/A | 8.6 HIGH |
| Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network. | |||||