Monthly
openstack-network-exporter can be made to silently skip basic authentication when an operator enables user authentication but forgets or misconfigures TLS, letting an adjacent-network attacker pull OVS/OVN dataplane metrics without credentials. Only deployments in that specific non-default, inconsistent configuration are exposed; correct TLS deployments and deployments without authentication enabled are unaffected. The published CVSS is 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), but our assessment narrows this to AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - adjacency-limited, read-only information disclosure, with no integrity or availability impact and no public exploit identified at time of analysis.
Timing side-channel leakage in Bouncy Castle for Java (bc-java) versions before 1.86 exposes private-key information from NTRU post-quantum KEM operations because three modular-reduction helpers used the '%' operator, which compiles to an integer division whose latency depends on the secret operand. Affected call paths include key generation (secret polynomials f and g), encapsulation (message polynomials r and m), and decapsulation (coefficients recovered from the private key), and the CVSS 4.0 base score is 8.2 (assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality only). Exploitation requires the application to actually invoke NTRU KEM operations with a persistent/reused key and an attacker able to repeatedly measure operation timing with low jitter, so practical risk is limited to deployments that use NTRU and expose those operations to a co-located or low-latency timing observer; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), but a vendor patch is available and should be applied.
Timing-based leakage of the single recovery token in OpenBao lets a remote, unauthenticated attacker who can reach the instance while it is running in highly privileged recovery mode recover that token and then read or modify data on the OpenBao instance. The exposure is constrained to the transient recovery-mode break-glass state rather than the normal serving configuration, and exploitation requires collecting a large volume of low-noise timing samples against the recovery endpoint (reflected in the CVSS 4.0 rating of 9.2 with AC:H and AT:P, and in the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor addressed the flaw in OpenBao v2.6.0; no public exploit identified at time of analysis.
Timing side-channel in pay-rails Pay (≤ 11.6.1) allows unauthenticated remote attackers to recover the Paddle Billing webhook HMAC signature byte-by-byte and forge webhook events. The Pay::Webhooks::PaddleBillingController compares the computed SHA-256 HMAC against the attacker-supplied h1 header value with Ruby's non-constant-time String#==, so response timing leaks how much of the digest prefix matches. A forged, correctly signed webhook is accepted and enqueued as a Pay::Webhooks::ProcessJob, letting the attacker drive billing state changes such as provisioning paid features, recording refunds, or triggering customer notifications; public exploit code / PoC-level analysis exists per the SSVC exploitation status, and the flaw is fixed in 11.6.2.
Timing side-channel in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0-v9.0.3) enables unauthenticated remote attackers to perform black-box reverse engineering of internal secret values - such as HMAC keys or API signing tokens - by measuring statistically distinguishable response-time differences across repeated crafted requests. The CWE-208 root cause is a non-constant-time comparison operation in the module's payment verification logic, which leaks information about secret material byte-by-byte through observable latency variations. No public exploit code or CISA KEV listing has been identified, but the network-exposed nature of the payment endpoint makes the attack surface broadly reachable for any operator of the affected module.
Observable timing discrepancy in the Drupal Token Content Access module exposes token-protected content to brute-force enumeration via side-channel analysis. All module versions from 0.0.0 through 3.1.2 are affected; unauthenticated remote attackers (PR:N, AV:N per CVSS) can measure differential response times during token validation to reconstruct valid access tokens character-by-character, ultimately bypassing content access restrictions. No active exploitation has been confirmed (SSVC exploitation: none, EPSS 0.14%, no KEV listing), and a vendor patch is available per Drupal SA-CONTRIB-2026-090.
Password reset and account activation token comparison in Grav Login Plugin before 3.9.1 uses PHP's non-constant-time === operator instead of hash_equals(), exposing a CWE-208 timing oracle in both taskReset() (classes/Controller.php) and the activation handler (login.php). Combined with the absence of rate limiting on the token-submission endpoint, an unauthenticated network attacker can submit high-volume repeated token guesses against a known username and statistically recover a valid reset token via timing discrepancy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the vendor itself characterizes practical exploitability as low, and no end-to-end network exploitation has been demonstrated.
Timing side-channel in Net::OAuth before 0.33 for Perl allows remote unauthenticated attackers to recover valid signatures byte-by-byte by measuring server response latency during signature rejection. For HMAC-SHA1 and HMAC-SHA256 methods the oracle yields a forged HMAC token; under the PLAINTEXT signature method the comparison is performed directly against the signature key, meaning the timing oracle exposes the raw consumer_secret and token_secret. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the PLAINTEXT credential-exposure path is theoretically severe for any deployment relying on that method.
Non-constant-time password hash comparison in Relay's authentication layer exposes a timing side-channel that allows credential inference via statistical analysis of response latencies. Attackers who can issue repeated authentication requests and measure response timing with sufficient precision can progressively reconstruct valid hashes or credentials byte-by-byte. No KEV listing exists and no public exploit has been identified at time of analysis, though timing oracle attacks of this class are well-understood with established methodology and tooling.
Timing side-channel in AMD Vitis Libraries' ECDSA secp256k1 Security Module exposes private cryptographic keys to local attackers via statistical analysis of operation timing or electromagnetic emanations. Affected are versions prior to 2026.1 of the Vitis Libraries Security Module and Vitis Unified Installer for FPGAs and Adaptive SoCs on Windows. AMD has released version 2026.1 as the fix; no public exploit or active exploitation has been identified at time of analysis.
openstack-network-exporter can be made to silently skip basic authentication when an operator enables user authentication but forgets or misconfigures TLS, letting an adjacent-network attacker pull OVS/OVN dataplane metrics without credentials. Only deployments in that specific non-default, inconsistent configuration are exposed; correct TLS deployments and deployments without authentication enabled are unaffected. The published CVSS is 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), but our assessment narrows this to AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - adjacency-limited, read-only information disclosure, with no integrity or availability impact and no public exploit identified at time of analysis.
Timing side-channel leakage in Bouncy Castle for Java (bc-java) versions before 1.86 exposes private-key information from NTRU post-quantum KEM operations because three modular-reduction helpers used the '%' operator, which compiles to an integer division whose latency depends on the secret operand. Affected call paths include key generation (secret polynomials f and g), encapsulation (message polynomials r and m), and decapsulation (coefficients recovered from the private key), and the CVSS 4.0 base score is 8.2 (assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality only). Exploitation requires the application to actually invoke NTRU KEM operations with a persistent/reused key and an attacker able to repeatedly measure operation timing with low jitter, so practical risk is limited to deployments that use NTRU and expose those operations to a co-located or low-latency timing observer; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), but a vendor patch is available and should be applied.
Timing-based leakage of the single recovery token in OpenBao lets a remote, unauthenticated attacker who can reach the instance while it is running in highly privileged recovery mode recover that token and then read or modify data on the OpenBao instance. The exposure is constrained to the transient recovery-mode break-glass state rather than the normal serving configuration, and exploitation requires collecting a large volume of low-noise timing samples against the recovery endpoint (reflected in the CVSS 4.0 rating of 9.2 with AC:H and AT:P, and in the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor addressed the flaw in OpenBao v2.6.0; no public exploit identified at time of analysis.
Timing side-channel in pay-rails Pay (≤ 11.6.1) allows unauthenticated remote attackers to recover the Paddle Billing webhook HMAC signature byte-by-byte and forge webhook events. The Pay::Webhooks::PaddleBillingController compares the computed SHA-256 HMAC against the attacker-supplied h1 header value with Ruby's non-constant-time String#==, so response timing leaks how much of the digest prefix matches. A forged, correctly signed webhook is accepted and enqueued as a Pay::Webhooks::ProcessJob, letting the attacker drive billing state changes such as provisioning paid features, recording refunds, or triggering customer notifications; public exploit code / PoC-level analysis exists per the SSVC exploitation status, and the flaw is fixed in 11.6.2.
Timing side-channel in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0-v9.0.3) enables unauthenticated remote attackers to perform black-box reverse engineering of internal secret values - such as HMAC keys or API signing tokens - by measuring statistically distinguishable response-time differences across repeated crafted requests. The CWE-208 root cause is a non-constant-time comparison operation in the module's payment verification logic, which leaks information about secret material byte-by-byte through observable latency variations. No public exploit code or CISA KEV listing has been identified, but the network-exposed nature of the payment endpoint makes the attack surface broadly reachable for any operator of the affected module.
Observable timing discrepancy in the Drupal Token Content Access module exposes token-protected content to brute-force enumeration via side-channel analysis. All module versions from 0.0.0 through 3.1.2 are affected; unauthenticated remote attackers (PR:N, AV:N per CVSS) can measure differential response times during token validation to reconstruct valid access tokens character-by-character, ultimately bypassing content access restrictions. No active exploitation has been confirmed (SSVC exploitation: none, EPSS 0.14%, no KEV listing), and a vendor patch is available per Drupal SA-CONTRIB-2026-090.
Password reset and account activation token comparison in Grav Login Plugin before 3.9.1 uses PHP's non-constant-time === operator instead of hash_equals(), exposing a CWE-208 timing oracle in both taskReset() (classes/Controller.php) and the activation handler (login.php). Combined with the absence of rate limiting on the token-submission endpoint, an unauthenticated network attacker can submit high-volume repeated token guesses against a known username and statistically recover a valid reset token via timing discrepancy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the vendor itself characterizes practical exploitability as low, and no end-to-end network exploitation has been demonstrated.
Timing side-channel in Net::OAuth before 0.33 for Perl allows remote unauthenticated attackers to recover valid signatures byte-by-byte by measuring server response latency during signature rejection. For HMAC-SHA1 and HMAC-SHA256 methods the oracle yields a forged HMAC token; under the PLAINTEXT signature method the comparison is performed directly against the signature key, meaning the timing oracle exposes the raw consumer_secret and token_secret. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the PLAINTEXT credential-exposure path is theoretically severe for any deployment relying on that method.
Non-constant-time password hash comparison in Relay's authentication layer exposes a timing side-channel that allows credential inference via statistical analysis of response latencies. Attackers who can issue repeated authentication requests and measure response timing with sufficient precision can progressively reconstruct valid hashes or credentials byte-by-byte. No KEV listing exists and no public exploit has been identified at time of analysis, though timing oracle attacks of this class are well-understood with established methodology and tooling.
Timing side-channel in AMD Vitis Libraries' ECDSA secp256k1 Security Module exposes private cryptographic keys to local attackers via statistical analysis of operation timing or electromagnetic emanations. Affected are versions prior to 2026.1 of the Vitis Libraries Security Module and Vitis Unified Installer for FPGAs and Adaptive SoCs on Windows. AMD has released version 2026.1 as the fix; no public exploit or active exploitation has been identified at time of analysis.