Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.
Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tabExplore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.
Recent security developmentsObservable timing discrepancy in Windows Schannel allows an unauthorized attacker to execute code over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate temp_authuserid and load that account's user_settings before authentication succeeds. Existing usernames can therefore cause an additional database query and may apply visible customized settings, while nonexistent usernames skip that behavior. A remote unauthenticated actor can use timing or page differences to enumerate valid accounts for later credential attacks. This issue is fixed in version 8.3.0.
No structured fix or guidance is available here. Check the latest publisher advisory.
Public exploit reference
HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs password-hash verification only when the submitted username matches an existing account, while unknown usernames return immediately. Although both paths return the same 401 unauthorized response, the processing-time discrepancy allows an unauthenticated remote attacker to distinguish registered email addresses; rate limiting only reduces the number of attempts per window. This issue is fixed in version 0.27.0.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication through Point#mul or scalar_multiply_ct can leak timing information about a secret scalar when compiled by a toolchain that reconstructs branchless selection into a branch. The Montgomery ladder uses uint256_select with an all-zeros or all-ones mask, but affected GCC builds at -O2 recover the original condition and emit secret-dependent je or jne jumps whose timing correlates with scalar bits. This defeats the assumption behind the 0.17.0 jp_add_internal infinity-branch fix. A consumer must multiply a secret private key or nonce in a context where an attacker can observe timing; repeated measurements can statistically recover scalar bits. The defect is in the compiled binary, so source review or ctgrind on a non-reconstructing toolchain may miss it. GCC 14.3.0, 15.1.0, and 15.2.0 reproduced the branch reconstruction, and extconf.rb appends -O2. Tested GCC versions through 12.4.0 used bitwise operations and GCC 13.3.0 used constant-time cmov; the pure-Ruby path is not affected by this flaw and separately makes no constant-time claim. GCC 16 and clang were untested, and point releases, targets, and flag combinations were not exhaustively bisected. Earlier pre-0.17.0 versions had different constant-time issues rather than this introduced select idiom. Version 0.18.0 contains the verified fix. The advisory's broad pre-0.18.0 guidance also covers earlier, different constant-time issues; whether this CVE groups those issues or only the select idiom introduced in 0.17.0 remains unresolved.
No structured fix or guidance is available here. Check the latest publisher advisory.
Public exploit reference
Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the /api/auth/login endpoint reveals whether a username exists through a timing discrepancy. In backend/src/main/java/com/picsou/controller/AuthController.java, AuthController.login() throws BadCredentialsException immediately for an unknown username, before passwordEncoder.matches(...), whereas an existing username with an incorrect password incurs the bcrypt comparison cost. Both cases return the same generic HTTP 401 response, but repeated latency measurements disclose valid usernames without credentials. Login rate limiting, a small user population, and deployments inaccessible from outside the local network limit practical exposure; the weakness does not itself read or modify account data, though enumerated usernames can assist credential stuffing or brute-force attacks. This issue is fixed in repository release 1.0.8.
No structured fix or guidance is available here. Check the latest publisher advisory.
Public exploit reference
An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback.
Recorded fixes — jose: 1.11.13. Check your release branch.
Public exploit reference
Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
A timing-based side-channel flaw exists in the rust-openssl package, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages for decryption. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
