CWE-203 Observable Discrepancy

Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Ghost: Invite Token Disclosure in Ghost Admin API

Backstage has improper input validation in scaffolder task list ordering

Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Withdrawn Advisory: Username enumeration attack in goauthentik

Dompdf: File existence oracle via font-face stylesheet declaration

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

NocoDB: Plaintext Password Comparison in Shared Views

GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer

vantage6 vulnerable to Observable Response Discrepancy

Weblate Vulnerable to Private Translation Enumeration via Screenshot API

Marvin Attack: potential key recovery through timing sidechannels

Parse Server has a protected field change detection oracle via LiveQuery watch parameter

Mattermost fails to use consistent error responses when handling the /mute command

Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

OpenClaw safeBins file-existence oracle information disclosure

Python Cryptography package vulnerable to Bleichenbacher timing oracle attack

m2crypto Bleichenbacher timing attack - incomplete fix for CVE-2020-25657

Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake

Exposure of Sensitive Information in snipe/snipe-it

curve25519-dalek has timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`

Directus Vulnerable to User Enumeration via Password Reset Timing Attack

CI4MS Vulnerable to User Email Enumeration via Password Reset Flow

/user/sessions endpoint allows detecting valid accounts