Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-208
Weakness type CWE-208 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 78 | 76 | 0 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▃▅▆█▆▃
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 6 · 2026-06 12 · 2026-07 14 · 2026-08 21 · 2026-09 16 · 2026-10 7
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2023-5981 | 5.9 | 69.3 | — | Gnutls: timing side-channel in the rsa-psk authentication |
| CVE-2026-47783 | 8.1 | 69.2 | — | — |
| CVE-2026-77987 | 9.3 | 58.3 | — | GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery |
| CVE-2023-24035 | 3.5 | 54.7 | — | — |
| CVE-2026-88010 | 6.3 | 51.9 | — | Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enu… |
| CVE-2026-8794 | 6.9 | 51.3 | — | PaperCut NG/MF: User enumeration via timing attack |
| CVE-2026-5419 | 3.7 | 49.1 | — | Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal |
| CVE-2026-48859 | 6.3 | 48.8 | — | SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated user… |
| CVE-2026-44255 | 5.3 | 48.5 | — | Wazuh: Username Enumeration via Timing Side-Channel |
| CVE-2024-42512 | 8.6 | 47.6 | — | — |
| CVE-2026-70658 | 7.4 | 46.4 | — | pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature ve… |
| CVE-2026-47784 | 8.1 | 44.8 | — | — |
| CVE-2026-75589 | 7.5 | 42.1 | — | Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT sig… |
| CVE-2026-54411 | 6.9 | 41.5 | — | Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison |
| CVE-2026-13183 | 7.5 | 41.3 | — | RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX |
| CVE-2026-63132 | 9.2 | 41.2 | — | OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack |
| CVE-2026-6656 | 7.5 | 40.9 | — | Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks |
| CVE-2026-47373 | 7.5 | 40.9 | — | Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks |
| CVE-2026-77582 | 6.9 | 40.1 | — | Tinyauth: User enumeration attack by timing oracle |
| CVE-2026-54685 | 5.3 | 39.1 | — | FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| red hat | 4 |
| amd | 3 |
| legion of the bouncy castle | 3 |
| op-tee | 3 |
| openssl | 3 |
| cockpit-hq | 2 |
| drupal | 2 |
| getgrav | 2 |
| memcached | 2 |
| oberon microsystems | 2 |
| omicron electronics | 2 |
| apache | 1 |
| arodland | 1 |
| coollabsio | 1 |
| dgtlmoon | 1 |
