CWE-204 · 197 records

Observable Response Discrepancy

CVEs in this class

197 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
37Monitor	CVE-2018-25350No exploit	userSpice 4.3.24 Username Enumeration via existingUsernameCheck.phpuserspice · userspice · CWE-204 Pre-auth	Critical9.3	—	0.4%	May 23, 2026
36Monitor	CVE-2026-33419No exploit	MinIO: LDAP login brute-force via user enumeration and missing rate limitminio · minio · CWE-204 Pre-auth	Critical9.1	—	0.5%	Mar 24, 2026
36Monitor	CVE-2026-60007No exploit	In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding aeclipse · milo · CWE-204 Pre-auth	Critical9.1	—	0.5%	Aug 4, 2026
36Monitor	CVE-2026-111235No exploit	OpenNMS REST authorization bypass via non-canonical HTTP methodthe opennms group · meridian · CWE-204 Pre-auth Auth bypass	Critical9.1	—	0.3%	Oct 15, 2026
36Monitor	CVE-2026-15747No exploit	Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oraclesri · mojolicious · CWE-204 Pre-auth CSRF	Critical9.1	—	0.2%	Jul 14, 2026
35Monitor	CVE-2025-5485No exploit	SinoTrack GPS Receiver Weak Authenticationsinotrack · iot pc platform · CWE-204 Pre-auth	High8.8	—	0.4%	Jun 12, 2025
34Monitor	CVE-2026-69519No exploit	Azure Stack HCI Information Disclosure Vulnerabilitymicrosoft · azure stack hci · CWE-204 Pre-auth	High8.6	—	1.0%	Aug 20, 2026
30Monitor	CVE-2021-20049No exploit	A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration basesonicwall · sma 100 firmware · CWE-204 Pre-auth	High7.5	—	1.3%	Dec 22, 2021
30Monitor	CVE-2021-34580No exploit	Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0mbconnectline · mbconnect24 · CWE-204 Pre-auth	High7.5	—	1.0%	Oct 27, 2021
30Monitor	CVE-2024-24766No exploit	CasaOS Username Enumerationicewhale · casaos-userservice · CWE-204 Pre-auth	High7.5	—	0.7%	Mar 6, 2024
30Monitor	CVE-2024-28232No exploit	Username Enumeration in CasaOS via bypass of CVE-2024-24766icewhale · casaos-userservice · CWE-204 Pre-auth	High7.5	—	0.6%	Apr 1, 2024
30Monitor	CVE-2025-3092No exploit	MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24helmholz · myrex24 · CWE-204 Pre-auth	High7.5	—	0.4%	Jun 24, 2025
30Monitor	CVE-2026-27462No exploit	Combodo iTop: User enumeration via password resetcombodo · itop · CWE-204 Pre-auth	High7.5	—	0.4%	Aug 21, 2026
30Monitor	CVE-2024-38322No exploit	IBM Storage Defender information disclosureibm · storage defender resiliency service · CWE-204 Pre-auth	High7.5	—	0.4%	Jun 28, 2024
30Monitor	CVE-2024-38431No exploit	Matrix Tafnit v8 - CWE-204: Observable Response Discrepancymatrix-globalservices · tafnit · CWE-204 Pre-auth	High7.5	—	0.3%	Jul 30, 2024
30Monitor	CVE-2025-23193No exploit	Information Disclosure vulnerability in SAP NetWeaver Application Server ABAPsap · sap basis · CWE-204 Pre-auth	High7.5	—	0.3%	Feb 10, 2025
30Monitor	CVE-2024-42343No exploit	Loway - CWE-204: Observable Response Discrepancyloway · queuemetrics · CWE-204 Pre-auth	High7.5	—	0.3%	Sep 8, 2024
30Monitor	CVE-2025-46390No exploit	CWE-204: Observable Response Discrepancyemby · mediabrowser · CWE-204 Pre-auth	High7.5	—	0.3%	Aug 6, 2025
30Monitor	CVE-2026-19080No exploit	Username Enumeration in Menulux Software's Menulux Portalmenulux software inc. · menulux portal · CWE-204 Pre-auth	High7.5	—	0.3%	Sep 4, 2026
30Monitor	CVE-2026-19205No exploit	User Enumeration in GastroMenum's GastroMenum Web Panelgastromenum · gastromenum web panel · CWE-204 Pre-auth	High7.5	—	0.2%	Sep 4, 2026
30Monitor	CVE-2026-14177No exploit	User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructureikas technology inc. · ikas e-commerce infrastructure · CWE-204 Pre-auth	High7.5	—	0.2%	Oct 16, 2026
28Monitor	CVE-2026-4113No exploit	An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN ussonicwall · sma6210 firmware · CWE-204	High7.2	—	0.5%	Apr 9, 2026
28Monitor	CVE-2026-86758No exploit	Snipe-IT before 8.7.0 License Key Exposure via CSV Exportsnipeitapp · snipe-it · CWE-204	High7.1	—	0.4%	Sep 9, 2026
28Monitor	CVE-2026-104439No exploit	YesWiki before 4.6.7 User Enumeration via Lost-Password Flowyeswiki · yeswiki · CWE-204 Pre-auth	High7.1	—	0.3%	Oct 2, 2026
27Monitor	CVE-2022-41697Proof of concept	A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4.ghost · ghost · CWE-204 Pre-auth	Medium5.3	—	20.0%	Dec 22, 2022

CVE-2018-25350
37Monitor
userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
userspice · userspiceMay 23, 2026
CVE-2026-33419
36Monitor
MinIO: LDAP login brute-force via user enumeration and missing rate limit
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
minio · minioMar 24, 2026
CVE-2026-60007
36Monitor
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding a
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
eclipse · miloAug 4, 2026
CVE-2026-111235
36Monitor
OpenNMS REST authorization bypass via non-canonical HTTP method
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
the opennms group · meridianOct 15, 2026
CVE-2026-15747
36Monitor
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- CSRF
sri · mojoliciousJul 14, 2026
CVE-2025-5485
35Monitor
SinoTrack GPS Receiver Weak Authentication
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
sinotrack · iot pc platformJun 12, 2025
CVE-2026-69519
34Monitor
Azure Stack HCI Information Disclosure Vulnerability
HighCVSS 8.6No exploitEPSS 1%
- Pre-auth
microsoft · azure stack hciAug 20, 2026
CVE-2021-20049
30Monitor
A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration base
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
sonicwall · sma 100 firmwareDec 22, 2021
CVE-2021-34580
30Monitor
Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
mbconnectline · mbconnect24Oct 27, 2021
CVE-2024-24766
30Monitor
CasaOS Username Enumeration
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
icewhale · casaos-userserviceMar 6, 2024
CVE-2024-28232
30Monitor
Username Enumeration in CasaOS via bypass of CVE-2024-24766
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
icewhale · casaos-userserviceApr 1, 2024
CVE-2025-3092
30Monitor
MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
helmholz · myrex24Jun 24, 2025
CVE-2026-27462
30Monitor
Combodo iTop: User enumeration via password reset
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
combodo · itopAug 21, 2026
CVE-2024-38322
30Monitor
IBM Storage Defender information disclosure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
ibm · storage defender resiliency serviceJun 28, 2024
CVE-2024-38431
30Monitor
Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
matrix-globalservices · tafnitJul 30, 2024
CVE-2025-23193
30Monitor
Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
sap · sap basisFeb 10, 2025
CVE-2024-42343
30Monitor
Loway - CWE-204: Observable Response Discrepancy
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
loway · queuemetricsSep 8, 2024
CVE-2025-46390
30Monitor
CWE-204: Observable Response Discrepancy
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
emby · mediabrowserAug 6, 2025
CVE-2026-19080
30Monitor
Username Enumeration in Menulux Software's Menulux Portal
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
menulux software inc. · menulux portalSep 4, 2026
CVE-2026-19205
30Monitor
User Enumeration in GastroMenum's GastroMenum Web Panel
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
gastromenum · gastromenum web panelSep 4, 2026
CVE-2026-14177
30Monitor
User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
ikas technology inc. · ikas e-commerce infrastructureOct 16, 2026
CVE-2026-4113
28Monitor
An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN us
HighCVSS 7.2No exploitEPSS 0%
sonicwall · sma6210 firmwareApr 9, 2026
CVE-2026-86758
28Monitor
Snipe-IT before 8.7.0 License Key Exposure via CSV Export
HighCVSS 7.1No exploitEPSS 0%
snipeitapp · snipe-itSep 9, 2026
CVE-2026-104439
28Monitor
YesWiki before 4.6.7 User Enumeration via Lost-Password Flow
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
yeswiki · yeswikiOct 2, 2026
CVE-2022-41697
27Monitor
A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4.
MediumCVSS 5.3Proof of conceptEPSS 20%
- Pre-auth
ghost · ghostDec 22, 2022

All vulnerability classes