Monthly
Unauthenticated user enumeration in YesWiki before 4.6.7 allows remote attackers to confirm registered email addresses by observing differing responses from the MotDePassePerdu lost-password recovery endpoint, which lacks rate limiting. This CWE-204 information disclosure does not expose credentials or account contents but enables targeted phishing and password-spraying campaigns. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 4.6.7.
License key exposure in Snipe-IT before 8.7.0 allows any authenticated low-privilege user to bypass the viewKeys authorization gate and retrieve all product license keys stored in the system. Two distinct exploitation paths exist: bulk extraction via the CSV export endpoint and a key-validation oracle via observable API response discrepancies, making CWE-204 an accurate root-cause classification for the latter. No public exploit code or CISA KEV listing exists at time of analysis; the patch is available in version 8.7.0.
Observable response discrepancy in GastroMenum Web Panel exposes account existence to unauthenticated remote attackers via differential server responses, enabling systematic account footprinting. All versions prior to 31.08.2026 of the web panel are affected. Reported by TR-CERT, this flaw (CWE-204) allows an attacker to distinguish valid from invalid accounts without any credentials, providing a reliable enumeration primitive for downstream attacks such as credential stuffing or targeted phishing. No public exploit code or CISA KEV listing identified at time of analysis.
Observable response discrepancy in Menulux Portal (all builds before 20260903211448) enables unauthenticated account footprinting against the portal's login or account-resolution endpoint. By observing measurable differences in server responses - such as distinct HTTP status codes, error messages, or timing - for valid versus invalid account identifiers, an attacker can systematically enumerate existing user accounts. Reported by TR-CERT with no public exploit code or CISA KEV listing identified at time of analysis.
User enumeration in Combodo iTop prior to version 3.2.3 allows remote unauthenticated attackers to identify valid accounts by observing distinct error responses in the forgot-password mechanism. The application returned different messages depending on account state - external authentication, fixed password, missing email - making it possible to distinguish valid usernames from invalid ones without any credentials. No public exploit code has been identified at time of analysis, and the issue is resolved in iTop 3.2.3 per the vendor's GitHub Security Advisory GHSA-888g-gv33-xwwx.
Azure Stack HCI exposes sensitive information to unauthenticated remote attackers via observable response discrepancy (CWE-204), where the system returns distinguishably different responses to distinct inputs, enabling enumeration or inference of confidential data without credentials. The CVSS 3.1 vector's Changed scope (S:C/C:H) signals that the disclosed information extends beyond the vulnerable component - significant in a hyperconverged platform managing compute, storage, and networking workloads with Azure integration. No public exploit code has been identified at time of analysis, but a vendor patch is available through the Microsoft Security Response Center.
Password recovery in Eclipse Milo (the open-source OPC UA SDK for Java) versions 0.6.0 through 1.1.4 allows an on-path attacker to break username-token confidentiality via a Bleichenbacher-style padding oracle. The server returns distinguishable error responses for invalid RSA PKCS#1 v1.5 padding versus other authentication failures during username-token processing, so an attacker who captures a victim's Basic128Rsa15-encrypted username token can send repeated unauthenticated ActivateSession requests to recover the cleartext password and then authenticate as the victim. No public exploit identified at time of analysis and it is not listed in CISA KEV; the weakness and its upstream fix are confirmed by the Eclipse Foundation.
CSRF token disclosure in the Perl Mojolicious web framework (versions 4.59 up to but not including 9.48) allows a network attacker to recover a victim's session CSRF token via a BREACH compression side channel and then bypass csrf_protect validation. Because _csrf_token cached and returned one stable per-session value that _csrf_field embedded in every response, an attacker who could inject reflected input into a gzip-compressed page could iteratively guess the token by observing compressed response lengths. There is no public exploit identified at time of analysis, EPSS is low (0.15%), and it is not in CISA KEV, but SSVC rates technical impact as total and automatable as yes.
Information disclosure in HAVELSAN Geographic Tracking System versions prior to v0.0.2 allows remote unauthenticated attackers to perform system footprinting by analyzing observable discrepancies in server responses. The CVSS 9.1 score reflects high confidentiality and integrity impact over the network with no authentication required, though no public exploit identified at time of analysis. The vulnerability was reported by Turkey's national CERT (TR-CERT), suggesting it primarily affects deployments within Turkey's defense and government sectors where HAVELSAN products are commonly used.
SonicWall SMA1000 SSL VPN appliances allow remote authenticated administrators to enumerate valid user credentials through observable timing or response differences. Affects SMA1000 versions 12.4.3-03245 and earlier, plus 12.5.0-02283 and earlier. While CVSS rates this 7.2 High, real-world risk is moderate: exploitation requires existing high-privilege access (PR:H), EPSS shows only 0.04% probability (11th percentile), and no active exploitation or public POC identified at time of analysis. The vulnerability enables credential harvesting for subsequent lateral movement attacks.
Unauthenticated user enumeration in YesWiki before 4.6.7 allows remote attackers to confirm registered email addresses by observing differing responses from the MotDePassePerdu lost-password recovery endpoint, which lacks rate limiting. This CWE-204 information disclosure does not expose credentials or account contents but enables targeted phishing and password-spraying campaigns. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 4.6.7.
License key exposure in Snipe-IT before 8.7.0 allows any authenticated low-privilege user to bypass the viewKeys authorization gate and retrieve all product license keys stored in the system. Two distinct exploitation paths exist: bulk extraction via the CSV export endpoint and a key-validation oracle via observable API response discrepancies, making CWE-204 an accurate root-cause classification for the latter. No public exploit code or CISA KEV listing exists at time of analysis; the patch is available in version 8.7.0.
Observable response discrepancy in GastroMenum Web Panel exposes account existence to unauthenticated remote attackers via differential server responses, enabling systematic account footprinting. All versions prior to 31.08.2026 of the web panel are affected. Reported by TR-CERT, this flaw (CWE-204) allows an attacker to distinguish valid from invalid accounts without any credentials, providing a reliable enumeration primitive for downstream attacks such as credential stuffing or targeted phishing. No public exploit code or CISA KEV listing identified at time of analysis.
Observable response discrepancy in Menulux Portal (all builds before 20260903211448) enables unauthenticated account footprinting against the portal's login or account-resolution endpoint. By observing measurable differences in server responses - such as distinct HTTP status codes, error messages, or timing - for valid versus invalid account identifiers, an attacker can systematically enumerate existing user accounts. Reported by TR-CERT with no public exploit code or CISA KEV listing identified at time of analysis.
User enumeration in Combodo iTop prior to version 3.2.3 allows remote unauthenticated attackers to identify valid accounts by observing distinct error responses in the forgot-password mechanism. The application returned different messages depending on account state - external authentication, fixed password, missing email - making it possible to distinguish valid usernames from invalid ones without any credentials. No public exploit code has been identified at time of analysis, and the issue is resolved in iTop 3.2.3 per the vendor's GitHub Security Advisory GHSA-888g-gv33-xwwx.
Azure Stack HCI exposes sensitive information to unauthenticated remote attackers via observable response discrepancy (CWE-204), where the system returns distinguishably different responses to distinct inputs, enabling enumeration or inference of confidential data without credentials. The CVSS 3.1 vector's Changed scope (S:C/C:H) signals that the disclosed information extends beyond the vulnerable component - significant in a hyperconverged platform managing compute, storage, and networking workloads with Azure integration. No public exploit code has been identified at time of analysis, but a vendor patch is available through the Microsoft Security Response Center.
Password recovery in Eclipse Milo (the open-source OPC UA SDK for Java) versions 0.6.0 through 1.1.4 allows an on-path attacker to break username-token confidentiality via a Bleichenbacher-style padding oracle. The server returns distinguishable error responses for invalid RSA PKCS#1 v1.5 padding versus other authentication failures during username-token processing, so an attacker who captures a victim's Basic128Rsa15-encrypted username token can send repeated unauthenticated ActivateSession requests to recover the cleartext password and then authenticate as the victim. No public exploit identified at time of analysis and it is not listed in CISA KEV; the weakness and its upstream fix are confirmed by the Eclipse Foundation.
CSRF token disclosure in the Perl Mojolicious web framework (versions 4.59 up to but not including 9.48) allows a network attacker to recover a victim's session CSRF token via a BREACH compression side channel and then bypass csrf_protect validation. Because _csrf_token cached and returned one stable per-session value that _csrf_field embedded in every response, an attacker who could inject reflected input into a gzip-compressed page could iteratively guess the token by observing compressed response lengths. There is no public exploit identified at time of analysis, EPSS is low (0.15%), and it is not in CISA KEV, but SSVC rates technical impact as total and automatable as yes.
Information disclosure in HAVELSAN Geographic Tracking System versions prior to v0.0.2 allows remote unauthenticated attackers to perform system footprinting by analyzing observable discrepancies in server responses. The CVSS 9.1 score reflects high confidentiality and integrity impact over the network with no authentication required, though no public exploit identified at time of analysis. The vulnerability was reported by Turkey's national CERT (TR-CERT), suggesting it primarily affects deployments within Turkey's defense and government sectors where HAVELSAN products are commonly used.
SonicWall SMA1000 SSL VPN appliances allow remote authenticated administrators to enumerate valid user credentials through observable timing or response differences. Affects SMA1000 versions 12.4.3-03245 and earlier, plus 12.5.0-02283 and earlier. While CVSS rates this 7.2 High, real-world risk is moderate: exploitation requires existing high-privilege access (PR:H), EPSS shows only 0.04% probability (11th percentile), and no active exploitation or public POC identified at time of analysis. The vulnerability enables credential harvesting for subsequent lateral movement attacks.