CWE-208 · 206 records

Observable Timing Discrepancy

CVEs in this class

206 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2021-43298No exploit	The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limitingembedthis · goahead · CWE-208 Pre-auth	Critical9.8	—	2.2%	Jan 25, 2022
39Monitor	CVE-2023-41313No exploit	Apache Doris: Timing Attack weaknessapache · doris · CWE-208 Pre-auth	Critical9.8	—	1.0%	Mar 12, 2024
39Monitor	CVE-2021-21575No exploit	Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy Vulnerability.dell · bsafe micro-edition-suite · CWE-208 Pre-auth	Critical9.8	—	0.5%	Feb 2, 2024
38Monitor	GHSA-xfqg-p48g-hh94No exploit	Login timing attack in ezsystems/ezpublish-kernelPackagist · ezsystems/ezpublish-kernel · CWE-208	Critical9.5	—	—	Jun 2, 2022
38Monitor	GHSA-2x4v-g8cx-jxrqNo exploit	Login timing attack in ibexa/corePackagist · ibexa/core · CWE-208	Critical9.5	—	—	Jun 2, 2022
38Monitor	GHSA-342c-vcff-2ff2No exploit	Login timing attack in ezsystems/ezplatform-kernelPackagist · ezsystems/ezplatform-kernel · CWE-208	Critical9.5	—	—	Jun 2, 2022
37Monitor	CVE-2026-77987No exploit	GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgerygithub · enterprise server · CWE-208 pre-auth RCE SSRF	Critical9.3	—	0.8%	Sep 22, 2026
36Monitor	CVE-2026-63132No exploit	OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attackopenbao · openbao · CWE-208 Pre-auth	Critical9.2	—	0.4%	Sep 23, 2026
35Monitor	CVE-2025-53940No exploit	Quiet uses insecure, inconsistent verification on local backend tokentryquiet · quiet · CWE-208	High8.5	—	3.7%	Jul 24, 2025
35Monitor	CVE-2026-23519No exploit	RustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnzrustcrypto · cmov · CWE-208 Pre-auth	High8.9	—	0.5%	Jan 15, 2026
34Monitor	CVE-2024-42512No exploit	Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication whenopcfoundation · ua .net standard stack · CWE-208 Pre-auth	High8.6	—	0.5%	Feb 10, 2025
34Monitor	CVE-2024-47178No exploit	basic-auth-connect's callback uses time unsafe string comparisonexpressjs · basic-auth-connect · CWE-208 Pre-auth	High8.7	—	0.5%	Sep 30, 2024
34Monitor	CVE-2026-72700No exploit	Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparisongetgrav · grav · CWE-208 Pre-auth	High8.7	—	0.4%	Aug 25, 2026
34Monitor	CVE-2026-43606No exploit	Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially peamd · vitis™ libraries - security module · CWE-208	High8.5	—	0.1%	Aug 11, 2026
34Monitor	GHSA-qv5f-57gw-vx3hNo exploit	Duplicate Advisory: Authorization Bypass in OPC UA .NET Standard StackNuGet · OPCFoundation.NetStandard.Opc.Ua · CWE-208 Pre-auth	High8.6	—	—	Feb 10, 2025
33Monitor	CVE-2026-16731No exploit	Authentication and authorization bypass via cryptographic timing side-channel attack in StationScoutomicron electronics gmbh · omicron stationscout · CWE-208 Pre-auth Auth bypass	High8.3	—	0.4%	Aug 6, 2026
32Monitor	CVE-2024-29995No exploit	Windows Kerberos Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-208 Pre-auth	High8.1	—	1.4%	Aug 13, 2024
32Monitor	CVE-2026-47783No exploit	In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon amemcached · memcached · CWE-208 Pre-auth	High8.1	—	1.2%	May 20, 2026
32Monitor	CVE-2026-28464No exploit	OpenClaw < 2026.2.12 - Timing Attack in Hooks Token Authenticationopenclaw · openclaw · CWE-208 Pre-auth	High8.2	—	0.7%	Mar 5, 2026
32Monitor	CVE-2023-25529No exploit	NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of nvidia · dgx h100 firmware · CWE-208 Pre-auth	High8.1	—	0.6%	Sep 19, 2023
32Monitor	CVE-2026-47784No exploit	In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by saslmemcached · memcached · CWE-208 Pre-auth	High8.1	—	0.5%	May 20, 2026
32Monitor	CVE-2024-31074No exploit	Observable timing discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via neCWE-208 Pre-auth	High8.2	—	0.5%	Nov 13, 2024
32Monitor	CVE-2026-3337No exploit	Timing Side-Channel in AES-CCM Tag Verification in AWS-LCamazon · aws-lc-fips-sys · CWE-208 Pre-auth	High8.2	—	0.4%	Mar 2, 2026
32Monitor	CVE-2026-41588No exploit	RELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key()inducer · relate · CWE-208 Pre-auth	High8.1	—	0.4%	May 8, 2026
32Monitor	CVE-2026-32935No exploit	phpseclib's AES-CBC unpadding susceptible to padding oracle timing attackphpseclib · phpseclib · CWE-208 Pre-auth	High8.2	—	0.4%	Mar 19, 2026

CVE-2021-43298
40Plan
The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
embedthis · goaheadJan 25, 2022
CVE-2023-41313
39Monitor
Apache Doris: Timing Attack weakness
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
apache · dorisMar 12, 2024
CVE-2021-21575
39Monitor
Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy Vulnerability.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
dell · bsafe micro-edition-suiteFeb 2, 2024
GHSA-xfqg-p48g-hh94
38Monitor
Login timing attack in ezsystems/ezpublish-kernel
CriticalCVSS 9.5No exploit
Packagist · ezsystems/ezpublish-kernelJun 2, 2022
GHSA-2x4v-g8cx-jxrq
38Monitor
Login timing attack in ibexa/core
CriticalCVSS 9.5No exploit
Packagist · ibexa/coreJun 2, 2022
GHSA-342c-vcff-2ff2
38Monitor
Login timing attack in ezsystems/ezplatform-kernel
CriticalCVSS 9.5No exploit
Packagist · ezsystems/ezplatform-kernelJun 2, 2022
CVE-2026-77987
37Monitor
GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- SSRF
github · enterprise serverSep 22, 2026
CVE-2026-63132
36Monitor
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
openbao · openbaoSep 23, 2026
CVE-2025-53940
35Monitor
Quiet uses insecure, inconsistent verification on local backend token
HighCVSS 8.5No exploitEPSS 3%
tryquiet · quietJul 24, 2025
CVE-2026-23519
35Monitor
RustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnz
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
rustcrypto · cmovJan 15, 2026
CVE-2024-42512
34Monitor
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
opcfoundation · ua .net standard stackFeb 10, 2025
CVE-2024-47178
34Monitor
basic-auth-connect's callback uses time unsafe string comparison
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
expressjs · basic-auth-connectSep 30, 2024
CVE-2026-72700
34Monitor
Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
getgrav · gravAug 25, 2026
CVE-2026-43606
34Monitor
Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially pe
HighCVSS 8.5No exploitEPSS 0%
amd · vitis™ libraries - security moduleAug 11, 2026
GHSA-qv5f-57gw-vx3h
34Monitor
Duplicate Advisory: Authorization Bypass in OPC UA .NET Standard Stack
HighCVSS 8.6No exploit
- Pre-auth
NuGet · OPCFoundation.NetStandard.Opc.UaFeb 10, 2025
CVE-2026-16731
33Monitor
Authentication and authorization bypass via cryptographic timing side-channel attack in StationScout
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
omicron electronics gmbh · omicron stationscoutAug 6, 2026
CVE-2024-29995
32Monitor
Windows Kerberos Elevation of Privilege Vulnerability
HighCVSS 8.1No exploitEPSS 1%
- Pre-auth
microsoft · windows 10 1507Aug 13, 2024
CVE-2026-47783
32Monitor
In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon a
HighCVSS 8.1No exploitEPSS 1%
- Pre-auth
memcached · memcachedMay 20, 2026
CVE-2026-28464
32Monitor
OpenClaw < 2026.2.12 - Timing Attack in Hooks Token Authentication
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
openclaw · openclawMar 5, 2026
CVE-2023-25529
32Monitor
NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
nvidia · dgx h100 firmwareSep 19, 2023
CVE-2026-47784
32Monitor
In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
memcached · memcachedMay 20, 2026
CVE-2024-31074
32Monitor
Observable timing discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via ne
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
Nov 13, 2024
CVE-2026-3337
32Monitor
Timing Side-Channel in AES-CCM Tag Verification in AWS-LC
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
amazon · aws-lc-fips-sysMar 2, 2026
CVE-2026-41588
32Monitor
RELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key()
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
inducer · relateMay 8, 2026
CVE-2026-32935
32Monitor
phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
phpseclib · phpseclibMar 19, 2026

All vulnerability classes