Observable Timing Discrepancy

Every one of the 210 is a mark on the map. Named now: 1 to 26, most at risk first.

1. MikroTik WinBox <= 6.49.17 - Username EnumerationCVE-2024-54772Mikrotik · CVSS 5.4 · 1.2% likely

   MikroTik

2. Quiet uses insecure, inconsistent verification on local backend tokenCVE-2025-53940TryQuiet · CVSS 8.5 · 4.2% likely
3. The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side-channel attacksCVE-2019-9494Wi-Fi Alliance · 3.9% likely

   Wi-Fi Alliance

4. Possible Information Leak / Session Hijack Vulnerability in RackCVE-2019-16782rack · CVSS 6.3 · 3.7% likely

   Rack

5. Timing attack in Cookie signature verificationCVE-2020-1926Apache Software Foundation · 2.5% likely

   Apache

6. The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated ne…CVE-2021-43298embedthis · 2.3% likely

   EmbedThis

7. Potential Timing Attack Vector in @fastify/bearer-authCVE-2022-31142fastify · CVSS 7.5 · 1.5% likely

   Fastify

8. Windows Kerberos Elevation of Privilege VulnerabilityCVE-2024-29995Microsoft · CVSS 8.1 · 1.5% likely

   Microsoft

9. Apache Hive: Timing Attack Against Signature in LLAP utilCVE-2024-23953Apache Software Foundation · CVSS 6.5 · 1.4% likely

   Apache

10. Gnutls: timing side-channel in the rsa-psk authenticationCVE-2023-5981Red Hat · CVSS 5.9 · 1.3% likely

    Red Hat

11. In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_ser…CVE-2026-47783memcached · CVSS 8.1 · 1.3% likelycovered by CyberSIXT

    Memcached

12. csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string comparison, instead of a time constant string…CVE-2016-10535HackerOne · 1.3% likely

    HackerOne

13. Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channelCVE-2023-45287Go standard library · 1.3% likely

    Go standard library

14. Search Guard versions before 21.0 had an timing side channel issue when using the internal user database.CVE-2019-13420floragunn · 1.2% likely

    Floragunn

15. Timing Side-Channel in AES-CCM Tag Verification in AWS-LCCVE-2026-3337AWS · CVSS 5.9 · 1.1% likely

    AWS

16. Cisco Unified Communications Products Timing Attack VulnerabilityCVE-2022-20752Cisco · CVSS 5.3 · 1.1% likely

    Cisco

17. Apache Doris: Timing Attack weaknessCVE-2023-41313Apache Software Foundation · CVSS 9.8 · 1.1% likely

    Apache

18. Timing attack in ShrineCVE-2020-15237shrinerb · CVSS 5.9 · 1.0% likely
19. python-ecdsa vulnerable to Minerva attack on P-256CVE-2024-23342tlsfuzzer · CVSS 7.4 · 1.0% likely
20. michaelliao jopenid OpenIdManager.java getAuthentication timing discrepancyCVE-2010-10006michaelliao · CVSS 2.6 · 0.9% likely
21. An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate…CVE-2024-39329Djangoproject · CVSS 5.3 · 0.9% likely

    Djangoproject

22. Windows Schannel Remote Code Execution VulnerabilityCVE-2026-119952Microsoft · CVSS 8.1 · 0.9% likelycovered by CyberSIXT

    Microsoft5 articles5 articles this week: Microsoft fixes 1,094 flaws, including exploited Outlook zero day

23. Observable Timing Discrepancy in totp-rsCVE-2022-29185constantoine · CVSS 4.2 · 0.9% likely
24. Username enumeration through timing difference in mod_wsgi authentication handlerCVE-2025-13473djangoproject · CVSS 5.3 · 0.8% likelycovered by CyberSIXT

    Djangoproject

25. Timing Attack Reveals CSRF Tokens in oppiaCVE-2023-40021oppia · CVSS 5.3 · 0.8% likely
26. agnivade easy-scrypt scrypt.go VerifyPassphrase timing discrepancyCVE-2014-125055agnivade · CVSS 2.6 · 0.8% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.