Apache TomEE's bundled JAAS login modules have a vulnerability where they leak information about username existence and perform credential comparisons in a non-constant-time manner. This allows a remote unauthenticated attacker to enumerate valid accounts and potentially infer credential material through timing analysis. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate temp_authuserid and load that account's user_settings before authentication succeeds. Existing usernames can therefore cause an additional database query and may apply visible customized settings, while nonexistent usernames skip that behavior. A remote unauthenticated actor can use timing or page differences to enumerate valid accounts for later credential attacks. This issue is fixed in version 8.3.0.
A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse Engineering.
This issue affects OpenText Directory Services (OTDS): from 22.1 to 26.2
A vulnerability in Gitea versions prior to 28.3.0 allowed exposure of contribution heatmap data from private repositories to holders of public-only access tokens. This flaw caused the GET /api/v1/users/{username}/heatmap endpoint to compute contribution counts using the repository access of the token owner, ignoring the intended public-only restriction. While repository names and contents were not disclosed, the contribution counts and their 15-minute time buckets from private repository activity were accessible. The issue has been fixed in version 28.3.0.
CVE-2026-65626 is a Bleichenbacher padding oracle vulnerability in the pure-Erlang RSAES-PKCS1-v1_5 decryption implementation of the jose_jwa_pkcs1 module in potatosalad jose. The vulnerability arises because the decryption function returns distinguishable error messages and timing differences based on padding validity, allowing an attacker to perform adaptive chosen-ciphertext attacks. This can lead to recovery of plaintext such as content-encryption keys or forging signatures. The issue affects versions from 1.3.0 up to but not including 1.11.13 and is fixed in version 1.11.13.
CVE-2025-13591 is a vulnerability in WSO2 Identity Server where the authentication endpoint reveals whether a username exists by providing inconsistent responses. This allows attackers to enumerate valid usernames, increasing the risk of targeted brute force, social engineering, and phishing attacks. The vulnerability has a medium severity with a CVSS score of 5.3. Fixed versions are available for affected releases.
CVE-2026-18560 is a vulnerability in Mattermost versions 11.7.x through 11.10.x where the application fails to properly validate user permissions before other checks. This flaw allows users without content reviewer privileges to infer whether a post has been flagged by making direct API calls. The issue is classified under CWE-203, indicating an observable discrepancy that leaks information. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-97788 is a high-severity vulnerability in Microsoft .NET Framework 3.5 related to an observable discrepancy in Active Directory Federation Services (AD FS) that allows unauthorized information disclosure over a network. The flaw affects multiple versions of the .NET Framework and Windows 10 builds. Microsoft has released official fixes for the affected versions.
CVE-2026-97782 is a vulnerability in Microsoft SharePoint Server Subscription Edition that allows an authorized attacker to perform tampering over a network due to an observable discrepancy. The flaw affects versions from 16.0.0 up to but not including 16.0.19725.20522. A fix is available in version 16.0.19725.20522. The vulnerability has a medium severity rating with a CVSS score of 6.8.
A vulnerability in TryGhost Ghost versions 4.39.0 up to 6.64.0 allowed staff users with permission to view staff invites to discover secret tokens of pending invites, including those for roles with higher privileges. This could enable privilege escalation by accepting such invites. The issue is fixed in version 6.64.0.
CVE-2026-105652 is a low-severity vulnerability in TryGhost Ghost versions from 0.7.2 up to but not including 6.64.0. It allows any staff-level user to observe the relative ordering of other staff users' hashed passwords. This information disclosure does not reveal the actual password hashes nor does it provide a practical method to recover passwords. The issue is fixed in version 6.64.0.
CVE-2026-11795 is an observable discrepancy vulnerability in Softtr Informatics Trading Limited Company's E-Commerce Pack that allows account footprinting. It affects versions before 5.03.01.54. The vulnerability has a medium severity with a CVSS score of 5.3 and does not require privileges or user interaction for exploitation.
CVE-2026-63573 is a high-severity vulnerability in Legion of the Bouncy Castle Inc.'s bc-csharp library before version 2.7.0. It involves an observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap process. This discrepancy allows a remote attacker, who can submit many modified CMS EnvelopedData messages to an application using the vulnerable library, to perform a Bleichenbacher-style adaptive chosen-ciphertext attack. The attacker can recover the content-encryption key of a captured message by distinguishing between different error messages during decryption, thus potentially decrypting the message content.
Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or ECIES ciphertext, and who can submit modified ciphertexts for decryption under the same key pair, to recover its plaintext via a CBC padding-oracle attack, because in block-cipher mode the engine decrypts the ciphertext and removes its padding before verifying the MAC. A padding failure is therefore reported with a different error message, and without the MAC computation, compared with a MAC failure. Only applications that construct IesEngine directly with a padded block cipher, such as AES in CBC mode with PKCS#7 padding, are affected; stream-mode IES is not.
The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process.
This weakness can be exploited by an attacker to discover valid usernames within the system. The impact is amplified for accounts that have not configured a mobile number, as the enumeration is specifically tied to this condition. The discovery of these usernames can facilitate subsequent brute force attacks, social engineering attempts, and information leakage, potentially leading to reputational damage, loss of customer trust, and regulatory non-compliance.
The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use.
This behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns.
Maravel PHP framework versions prior to 10.73.1 have a side-channel information disclosure vulnerability. When routes with dynamic placeholders are compiled, literal placeholder syntax can cause a 500 Internal Server Error instead of a 404 Not Found. This behavior allows an attacker to infer internal route parameter names and controller schemas by observing which inputs trigger errors. Version 10.73.1 includes a patch for this issue. A recommended workaround is to implement middleware that rejects requests containing literal brace patterns before routing.
WatchGuard Dimension version 2.0 has a vulnerability in its web login endpoint where effective rate-limiting or account lockout is not enforced by default. This allows a remote attacker to perform automated password guessing attacks against user accounts. While an account lockout setting exists to block brute-force attempts after a defined number of failures, it is not enabled by default.
CVE-2026-11754 is an observable discrepancy vulnerability in Seres Software syWEB that allows account footprinting. The product is no longer supported by the vendor. The vulnerability has a medium severity with a CVSS score of 5.3, indicating it can be exploited remotely without privileges or user interaction to gain limited information disclosure. No patch or remediation is currently available.
Weblate versions prior to 2026.7 have an information disclosure vulnerability where unauthorized users can infer the existence of objects in private projects due to differing HTTP response codes (403 vs 404). This discrepancy allows attackers to confirm whether certain objects exist without access. The issue is fixed in version 2026.7.