https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 03:15:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329767 EUVD-2026-329767 https://cve.radiocsirt.org/vuln/euvd-2026-329767 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47380 <p>NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison. This vulnerability is fixed in 2026.04.1.</p> <p>NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison. This vulnerability is fixed in 2026.04.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-47380 https://cve.radiocsirt.org/vuln/ghsa-jr54-jwhj-55gp <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary Sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison.</p> <p>### Details The unknown-user branch in `auth.service.ts` now performs a `bcrypt.compare` against a fixed dummy hash so the response time of failed sign-ins is approximately independent of whether the address exists. Rate limiting on the sign-in endpoint is implemented in the Enterprise build only and is not affected by this advisory.</p> <p>### Impact A network-positioned attacker could enumerate registered email addresses by timing sign-in responses. Exploitation requires only the ability to send unauthenticated sign-in requests.</p> <p>### Credit This issue was reported by [@AndyAnh174](https://github.com/AndyAnh174).</p> <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary Sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison.</p> <p>### Details The unknown-user branch in `auth.service.ts` now performs a `bcrypt.compare` against a fixed dummy hash so the response time of failed sign-ins is approximately independent of whether the address exists. Rate limiting on the sign-in endpoint is implemented in the Enterprise build only and is not affected by this advisory.</p> <p>### Impact A network-positioned attacker could enumerate registered email addresses by timing sign-in responses. Exploitation requires only the ability to send unauthenticated sign-in requests.</p> <p>### Credit This issue was reported by [@AndyAnh174](https://github.com/AndyAnh174).</p> https://cve.radiocsirt.org/vuln/ghsa-jr54-jwhj-55gp