CVE WatchOct 23, 2026

CVE-2026-49442

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an atta

CVSS

5.3

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 23, 2026 · Last modified: Oct 23, 2026 · CWE-204

EPSS · 30d

Not enough EPSS history yet.

Technical description

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on whether the provided username exists in the system. When username exists on Cacti, in the response, they see Access Denied! Login failed. When it does not exist on Cacti, they see Access Denied! Login Failed. The only difference between the responses is the capitalization of the letter "f" in the word failed. This issue has been patched in version 1.2.31.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2024-74785.8 MED

13.7%

——4When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store. The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.2d CVE-2026-111056—

20.0%

——6FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted email already exists. The trigger is an unauthenticated request to POST /api/guest/client/create with a target email address. An attacker can compare the guest-signup response for a target email to determine whether the email belongs to an existing FOSSBilling client. Box\Mod\Client\Api\Guest::create returns the error after Client\Service::clientAlreadyExists finds a matching record, and the API response exposes that exception message without redaction. This issue is fixed in version 0.8.7.2d CVE-2026-1118875.3 MED

16.9%

——5phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.5d CVE-2026-1056645.3 MED

25.6%

——8The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication or authorization - to distinguish valid ID values from the full 10-digit numeric search space. Combined with the absence of meaningful rate limiting on this endpoint, this discrepancy constitutes an enumeration oracle, enabling an attacker to discover registered devices at scale.7d CVE-2026-141777.5 HIG

14.9%

——4Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.7d CVE-2026-1113864.3 MED

10.7%

——3Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.7d