CVE-2026-9161

User Enumeration in DernekPlus' Website Template

Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dernekplus

Products

Website Template

CVE-2026-89173

Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Kingdom Communication Associated

Products

Eh1000b Eh2070 Eh3040 and 1 more

CVE-2026-86758

Snipe-IT before 8.7.0 License Key Exposure via CSV Export

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Grokability Snipeitapp

Products

Snipe-it Snipe-it

CVE-2026-87619

chromium-browser: chromium-browser: Observable discrepancy in Prefetch

Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-87566

chromium-browser: chromium-browser: Observable discrepancy in Layout

Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-19205

User Enumeration in GastroMenum's GastroMenum Web Panel

Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: before 31.08.2026.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Gastromenum

Products

Gastromenum Web Panel

CVE-2026-19080

Username Enumeration in Menulux Software's Menulux Portal

Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting. This issue affects Menulux Portal: before 20260903211448.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Menulux

Products

Menulux Portal

CVE-2026-78584

Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-84307

Filament: Password validity disclosure for accounts denied panel access on login page

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel(). For an account that canAccessPanel() denies, submitting the correct password renders the MFA challenge while an incorrect password returns the generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid for that account. When email-based MFA is configured, the correct-password path also sends a login code to the account holder. The issue applies only to accounts that have MFA enabled and are denied panel access. Authentication is not bypassed because canAccessPanel() still runs after the challenge, and no session is created. This issue is fixed in versions 4.12.5 and 5.7.5.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Filamentphp

Products

Filament

CVE-2026-14672

PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.6, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-81033

Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account raises an error that the global handler renders as a not-found status, while a registered address proceeds to send the reset message and returns no-content. The route is mounted without authentication. Submitting candidate addresses and comparing the two status codes therefore establishes which addresses hold accounts, with no credential and no rate limiting in the path.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Automatisch

Products

Automatisch

CVE-2026-27462

Combodo iTop: User enumeration via password reset

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-75575

Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset message for any address that matches an account. With no DDPRateLimiter rule registered for it, a caller can drive an unbounded volume of reset mail at a chosen address from the deployment's own mail sender, and can probe addresses at scale: the method answers true for an address with no account and for a successful send, but false when the address belongs to an account that authenticates through an external provider and Accounts_AllowPasswordChangeForOAuthUsers is off, so repeated calls distinguish that class of account. Later versions register a rule permitting ten calls per minute per client address.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Rocket.chat

Products

Rocket.chat

CVE-2026-69519

Azure Stack HCI Information Disclosure Vulnerability

Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 8.6 High EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Azure Stack Hci

CVE-2026-54739

Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/local_user/login.rs returns different errors depending on whether the username_or_email value exists. LocalUserView::find_by_email_or_name propagates a NotFound response for an unknown account, while an existing account with a wrong password returns LemmyErrorType::IncorrectLogin. This observable response discrepancy, including HTTP 404 for a nonexistent account and HTTP 400 for an incorrect password on an existing account, allows an unauthenticated attacker to confirm registered usernames or email addresses and use the results for targeted credential attacks or social engineering. This issue is fixed in versions 0.19.19 and 1.0.0-beta.1.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Lemmynet

Products

Lemmy

CVE-2026-19965

automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes observable response discrepancy. The attack can be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.0.0-beta.33 is able to resolve this issue. Patch name: eac0b05dafdb0ddf8b9139dad8929aaba86568ca. You should upgrade the affected component.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automad Marcantondahmen

Products

Automad Automad

CVE-2026-73306

Budibase: Account Enumeration via Login Lockout Response Differential

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Budibase

Products

Budibase

CVE-2026-72588

bluewave-labs Checkmate - User Enumeration via Differential HTTP Response in Password Recovery

A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bluewave-labs

Products

Checkmate

CVE-2026-55998

Cluster Existence Oracle via Unauthenticated Import Endpoint

The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Rancher

CVE-2026-14202

Username Enumeration via Differential Login Responses in Bilin Software's HUMANIST Digital Human Resources

Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bilin Software And Informatics Consultancy Inc.

Products

Humanist Digital Human Resources