CWE-208 · Information Disclosure
Observable Timing Discrepancy
210CVEs
0exploited
1with a public check
0likely (EPSS 10%+)
SortMost likely exploited
210 CVEs with CWE-208 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-54772CheckMikroTik WinBox <= 6.49.17 - Username EnumerationMikrotik · Routeros · CVSS 5.4 · 2025-02-11 | 5.4 | 1.2% | 2025-02-11 |
| CVE-2025-53940Quiet uses insecure, inconsistent verification on local backend tokenTryQuiet · quiet · CVSS 8.5 · 2025-07-24 | 8.5 | 4.2% | 2025-07-24 |
| CVE-2019-9494The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side-channel attacksWi-Fi Alliance · hostapd with SAE support · 2019-04-17 | – | 3.9% | 2019-04-17 |
| CVE-2019-16782Possible Information Leak / Session Hijack Vulnerability in Rackrack · rack · CVSS 6.3 · 2019-12-18 | 6.3 | 3.7% | 2019-12-18 |
| CVE-2020-1926Timing attack in Cookie signature verificationApache Software Foundation · Apache Hive · 2021-03-16 | – | 2.5% | 2021-03-16 |
| CVE-2021-43298The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated ne…embedthis · goahead · 2022-01-25 | – | 2.3% | 2022-01-25 |
| CVE-2022-31142Potential Timing Attack Vector in @fastify/bearer-authfastify · fastify-bearer-auth · CVSS 7.5 · 2022-07-14 | 7.5 | 1.5% | 2022-07-14 |
| CVE-2024-29995Windows Kerberos Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 8.1 · 2024-08-13 | 8.1 | 1.5% | 2024-08-13 |
| CVE-2024-23953Apache Hive: Timing Attack Against Signature in LLAP utilApache Software Foundation · Apache Hive · CVSS 6.5 · 2025-01-28 | 6.5 | 1.4% | 2025-01-28 |
| CVE-2023-5981Gnutls: timing side-channel in the rsa-psk authenticationRed Hat · Red Hat Enterprise Linux 8 · CVSS 5.9 · 2023-11-28 | 5.9 | 1.3% | 2023-11-28 |
| CVE-2026-47783In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_ser…memcached · memcached · CVSS 8.1 · 2026-05-20 | 8.1 | 1.3% | 2026-05-20 |
| CVE-2016-10535csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string comparison, instead of a time constant string…HackerOne · csrf-lite node module · 2018-05-31 | – | 1.3% | 2018-05-31 |
| CVE-2023-45287Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channelGo standard library · crypto/tls · 2023-12-05 | – | 1.3% | 2023-12-05 |
| CVE-2019-13420Search Guard versions before 21.0 had an timing side channel issue when using the internal user database.floragunn · Search Guard · 2019-08-13 | – | 1.2% | 2019-08-13 |
| CVE-2026-3337Timing Side-Channel in AES-CCM Tag Verification in AWS-LCAWS · AWS-LC · CVSS 5.9 · 2026-03-02 | 5.9 | 1.1% | 2026-03-02 |
| CVE-2022-20752Cisco Unified Communications Products Timing Attack VulnerabilityCisco · Cisco Unified Communications Manager · CVSS 5.3 · 2022-07-06 | 5.3 | 1.1% | 2022-07-06 |
| CVE-2023-41313Apache Doris: Timing Attack weaknessApache Software Foundation · Apache Doris · CVSS 9.8 · 2024-03-12 | 9.8 | 1.1% | 2024-03-12 |
| CVE-2020-15237Timing attack in Shrineshrinerb · shrine · CVSS 5.9 · 2020-10-05 | 5.9 | 1.0% | 2020-10-05 |
| CVE-2024-23342python-ecdsa vulnerable to Minerva attack on P-256tlsfuzzer · python-ecdsa · CVSS 7.4 · 2024-01-22 | 7.4 | 1.0% | 2024-01-22 |
| CVE-2010-10006michaelliao jopenid OpenIdManager.java getAuthentication timing discrepancymichaelliao · jopenid · CVSS 2.6 · 2023-01-17 | 2.6 | 0.9% | 2023-01-17 |
| CVE-2024-39329An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate…Djangoproject · Django · CVSS 5.3 · 2024-07-10 | 5.3 | 0.9% | 2024-07-10 |
| CVE-2026-119952Windows Schannel Remote Code Execution VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 8.1 · 2026-11-10 | 8.1 | 0.9% | 2026-11-10 |
| CVE-2022-29185Observable Timing Discrepancy in totp-rsconstantoine · totp-rs · CVSS 4.2 · 2022-05-20 | 4.2 | 0.9% | 2022-05-20 |
| CVE-2025-13473Username enumeration through timing difference in mod_wsgi authentication handlerdjangoproject · Django · CVSS 5.3 · 2026-02-03 | 5.3 | 0.8% | 2026-02-03 |
| CVE-2023-40021Timing Attack Reveals CSRF Tokens in oppiaoppia · oppia · CVSS 5.3 · 2023-08-16 | 5.3 | 0.8% | 2023-08-16 |
| CVE-2014-125055agnivade easy-scrypt scrypt.go VerifyPassphrase timing discrepancyagnivade · easy-scrypt · CVSS 2.6 · 2023-01-07 | 2.6 | 0.8% | 2023-01-07 |
| CVE-2014-125056Pylons horus services.py timing discrepancyPylons · horus · CVSS 2.6 · 2023-01-07 | 2.6 | 0.7% | 2023-01-07 |
| CVE-2023-24035An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforc…Nagios · Nagios XI · CVSS 3.5 · 2026-09-14 | 3.5 | 0.7% | 2026-09-14 |
| CVE-2013-10006Ziftr primecoin bitcoinrpc.cpp HTTPAuthorized timing discrepancyZiftr · primecoin · CVSS 2.6 · 2023-01-01 | 2.6 | 0.7% | 2023-01-01 |
| CVE-2021-4294OpenShift OSIN CheckClientSecret timing discrepancyOpenShift · OSIN · CVSS 2.6 · 2022-12-28 | 2.6 | 0.7% | 2022-12-28 |
| CVE-2025-59432Timing Attack Vulnerability in SCRAM Authenticationongres · scram · CVSS 6.6 · 2025-09-22 | 6.6 | 0.7% | 2025-09-22 |
| CVE-2022-4823InSTEDD Nuntium geopoll_controller.rb timing discrepancyInSTEDD · Nuntium · CVSS 3.1 · 2022-12-28 | 3.1 | 0.7% | 2022-12-28 |
| CVE-2016-15015viafintech Barzahlen Payment Module PHP SDK Webhook.php verify timing discrepancyviafintech · Barzahlen Payment Module PHP SDK · CVSS 2.6 · 2023-01-08 | 2.6 | 0.7% | 2023-01-08 |
| CVE-2026-8794PaperCut NG/MF: User enumeration via timing attackPaperCut · PaperCut NG/MF · CVSS 6.9 · 2026-08-03 | 6.9 | 0.7% | 2026-08-03 |
| CVE-2023-1538Observable Timing Discrepancy in answerdev/answeranswerdev · answerdev/answer · CVSS 5.3 · 2023-03-21 | 5.3 | 0.6% | 2023-03-21 |
| CVE-2026-63132OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attackopenbao · openbao · CVSS 9.2 · 2026-09-23 | 9.2 | 0.6% | 2026-09-23 |
| CVE-2021-42016A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGED…Siemens · RUGGEDCOM i800 · CVSS 7.5 · 2022-03-08 | 7.5 | 0.6% | 2022-03-08 |
| CVE-2026-77582Tinyauth: User enumeration attack by timing oracletinyauthapp · tinyauth · CVSS 6.9 · 2026-09-21 | 6.9 | 0.6% | 2026-09-21 |
| CVE-2023-25529NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of another user’s session token by observi…NVIDIA · DGX H100 BMC · CVSS 8 · 2023-09-20 | 8.0 | 0.6% | 2023-09-20 |
| CVE-2024-42368open-telemetry has an Observable Timing Discrepancyopen-telemetry · opentelemetry-collector-contrib · CVSS 6.5 · 2024-08-13 | 6.5 | 0.6% | 2024-08-13 |
| CVE-2026-44255Wazuh: Username Enumeration via Timing Side-Channelwazuh · wazuh · CVSS 5.3 · 2026-08-19 | 5.3 | 0.6% | 2026-08-19 |
| CVE-2021-26314AMD Speculative execution with Floating-Point Value InjectionAMD · All supported processors · 2021-06-09 | – | 0.6% | 2021-06-09 |
| CVE-2024-42512Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security…Opcfoundation · Ua .net Standard Stack · CVSS 8.6 · 2025-02-10 | 8.6 | 0.6% | 2025-02-10 |
| CVE-2026-70658pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifierpay-rails · pay · CVSS 7.4 · 2026-09-14 | 7.4 | 0.6% | 2026-09-14 |
| CVE-2025-68621Trilium Notes has a Timing Attack Vulnerability in /api/login/syncTriliumNext · Trilium · CVSS 7.4 · 2026-02-06 | 7.4 | 0.6% | 2026-02-06 |
| CVE-2026-23519RustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnzRustCrypto · utils · CVSS 8.9 · 2026-01-15 | 8.9 | 0.6% | 2026-01-15 |
| CVE-2026-33006Apache HTTP Server: mod_auth_digest timing attackApache Software Foundation · Apache HTTP Server · CVSS 4.8 · 2026-05-04 | 4.8 | 0.6% | 2026-05-04 |
| CVE-2024-45052Fides Webserver Authentication Timing-Based Username Enumeration Vulnerabilityethyca · fides · CVSS 5.3 · 2024-09-04 | 5.3 | 0.6% | 2024-09-04 |
| CVE-2024-52307authentik allows a timing attack due to missing constant time comparison for metrics viewgoauthentik · authentik · CVSS 6.3 · 2024-11-21 | 6.3 | 0.6% | 2024-11-21 |
| CVE-2026-47784In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.memcached · memcached · CVSS 8.1 · 2026-05-20 | 8.1 | 0.5% | 2026-05-20 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.