The Grav Login plugin before version 3.9.1 has an email address enumeration vulnerability. The register() method throws a distinct exception when an email is already registered, allowing attackers to confirm existing accounts. There is no rate limiting on the registration endpoint, enabling automated enumeration attacks.
Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expressions over the stored field that holds the value, and evaluated them with Kibana's own internal Elasticsearch privileges rather than the caller's. Because the number of matching agents is reported back to the caller, the difference between a matching and a non-matching filter formed a side channel from which the full API key value could be reconstructed one character at a time with a short sequence of requests.
CVE-2026-58445 is a low-severity vulnerability in Gitea Open Source Git Server affecting versions up to 1.26.4. It involves a cross-repository label-ID enumeration issue via the unscoped DeleteIssueLabel API, which could allow an attacker with high privileges to infer label IDs across repositories. The vulnerability does not impact confidentiality beyond limited information disclosure, nor does it affect integrity or availability.
: Observable Discrepancy vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions).
This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3.
CVE-2025-13736 is an information disclosure vulnerability in WSO2 Identity Server as Key Manager version 5.10.0. When Multi-Attribute Login is enabled, the login interface reveals whether a username exists by displaying the canonical username for valid users and echoing the original input for invalid users. This behavior occurs regardless of the validate_username configuration setting. The vulnerability can aid attackers in enumerating valid usernames, increasing the risk of brute force, social engineering, and phishing attacks.
CVE-2026-59640 is a high-severity vulnerability in Bouncy Castle for Java (BC-JAVA) involving an OpenPGP CFB quick-check oracle on symmetric/session-key paths. This affects versions before 1.85, versions from 2.73.0 up to but not including 2.73.12, and certain FIPS series versions. The vulnerability is categorized under CWE-203 (Observable Discrepancy). No official patch or remediation level has been confirmed yet.
Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation that allows unauthenticated attackers to enumerate organization existence. The function returns distinct error messages (NO_ORG vs NO_RIGHTS) when called with only a publishable API key, enabling attackers to discover valid organization IDs and increase the attack surface for targeted phishing or social engineering campaigns.
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username enumeration through response timing differences. This issue is fixed in version 3.3.0.
Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
Side-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-56327 is an information disclosure vulnerability in Capgo versions before 12.128.2. It affects the public.invite_user_to_org RPC function, allowing unauthenticated attackers to enumerate the existence of organizations by analyzing distinct error responses. This tenant enumeration is possible because the SECURITY DEFINER function returns different errors (NO_ORG versus NO_RIGHTS) depending on whether an organization ID exists.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct responses depending on whether the submitted email address belongs to an existing user account, allowing unauthenticated attackers to enumerate valid helpdesk agent email addresses. This vulnerability is fixed in 1.8.219.
TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before returning a 401 Unauthorized, adding ~370 ms of latency. When the email did not exist, the backend returned immediately (~10 ms). This ~14× timing difference could be detected without any difference in HTTP status codes or response bodies. This vulnerability is fixed in 3.0.18.
Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user. This issue has been patched in version 5.17.1.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0, an attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protected field value is properly stripped from event payloads, the presence or absence of update events reveals whether the protected field changed, creating a binary oracle. For boolean protected fields, the timing of change events is equivalent to knowing the field value. This issue has been patched in versions 8.6.54 and 9.6.0
go-ethereum (Geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. Geth maintainers recommend rotating the node key after applying the upgrade, which can be done by removing the file `<datadir>/geth/nodekey` before starting Geth.
GFI MailEssentials AI versions prior to 22.4 contain an arbitrary directory existence enumeration vulnerability in the ListServer.IsPathExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsPathExist. An authenticated user can supply an unrestricted filesystem path via the JSON key \"path\", which is URL-decoded and passed to Directory.Exists(), allowing the attacker to determine whether arbitrary directories exist on the server.
GFI MailEssentials AI versions prior to 22.4 contain an arbitrary file existence enumeration vulnerability in the ListServer.IsDBExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsDBExist. An authenticated user can supply an unrestricted filesystem path via the JSON key \"path\", which is URL-decoded and passed to File.Exists(), allowing the attacker to determine whether arbitrary files exist on the server.
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue.
CVE-2025-68164 is a low-severity information disclosure vulnerability in JetBrains TeamCity versions prior to 2025.11. It allows an authenticated user with high privileges to perform port enumeration via the Perforce connection test feature. The vulnerability does not impact integrity or availability and requires no user interaction beyond authentication. There are no known exploits in the wild, and no patches have been published yet. The CVSS score is 2.7, reflecting limited confidentiality impact and the need for privileged access. European organizations using TeamCity, especially those integrating Perforce for version control, should be aware of this issue. Mitigation involves restricting high-privilege access, monitoring usage of the Perforce connection test, and applying patches once available. Countries with significant software development sectors and JetBrains customer bases, such as Germany, France, and the UK, are more likely to be affected.
