CVE Watch13 de nov. de 2026

CVE-2026-126955

Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows una

CVSS

5.3

Média

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 13 de nov. de 2026 · Última mod.: 13 de nov. de 2026 · CWE-204

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-105671—

—

———The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.5h CVE-2026-68512—

35.1%

——11Paaster is a pastebin application. Prior to version 3.3.0, Paaster's account login has no rate limiting, lockout, or CAPTCHA of any kind, and a companion endpoint openly discloses whether a username exists along with that account's password-hashing salts. Together these let an attacker enumerate real accounts and then brute-force their passwords with unlimited, unthrottled attempts. This issue has been patched in version 3.3.0.23h CVE-2026-1244327.3 ALT

24.9%

——7phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in the unauthenticated POST /api/webauthn/prepare-login endpoint, which returns stable stored credential IDs for passkey-registered accounts but an md5(time())-derived fallback ID otherwise. Unauthenticated attackers can compare allowCredentials IDs from requests sent more than one second apart, without rate limiting, to identify existing passkey-registered accounts and their credential IDs.4d CVE-2026-1235174.3 MÉD

13.1%

——4Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member.3d CVE-2026-172025.3 MÉD

34.9%

——10IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to enumerate usernames due to observable differences in response behavior.3d CVE-2026-1003625.3 MÉD

29.9%

——9SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the /legacy/Api/V8/OAuth2 password-grant endpoint returns distinct error messages for an invalid username and an invalid password. An unauthenticated remote attacker can use those response differences to enumerate valid CRM usernames and target confirmed accounts with password spraying, credential stuffing, brute-force, or social-engineering attacks. This issue is fixed in versions 7.15.2 and 8.10.2.3d