CWE-208

212 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 6High 45Medium 120Low 41Not scored 0

CVEs per yearBy the year they were published

CVE-2026-103021
OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading
openemr · openemr
Medium5.3
CVE-2026-85286
HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay
sysadminsmedia · homebox
Low3.7
CVE-2026-74846
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier
Catalyst-Plugin-Authentication
High7.5
CVE-2026-63410
secp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplication
sgbett · secp256k1-native
Medium5.9
CVE-2026-62860
Picsou vulnerable to login timing attack
Zoeille · picsou-finance
Medium5.3
CVE-2026-93434
Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets
WatchGuard · Fireware OS
High8.7
CVE-2026-65630
Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose
potatosalad · jose
Medium5.9
CVE-2026-87946
SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144
Drupal · SAML SSO - Service Provider
Medium4.8
CVE-2026-24715
Lack of Reproducible Vulnerability Evidence in QNAP Report
QNAP Systems Inc. · QuRouter
Medium5.3
CVE-2026-49265
OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison
oauthlib · oauthlib
Medium6.8