CWE-208

210 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 6High 44Medium 119Low 40Not scored 1

CVEs per yearBy the year they were published

CVE-2026-74846
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier
Catalyst-Plugin-Authentication
Not scored
CVE-2026-63410
secp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplication
sgbett · secp256k1-native
Medium5.9
CVE-2026-62860
Picsou vulnerable to login timing attack
Zoeille · picsou-finance
Medium5.3
CVE-2026-93434
Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets
WatchGuard · Fireware OS
High8.7
CVE-2026-65630
Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose
potatosalad · jose
Medium5.9
CVE-2026-87946
SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144
Drupal · SAML SSO - Service Provider
Medium4.8
CVE-2026-24715
Lack of Reproducible Vulnerability Evidence in QNAP Report
QNAP Systems Inc. · QuRouter
Medium5.3
CVE-2026-49265
OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison
oauthlib · oauthlib
Medium6.8
CVE-2026-109379
Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check
cockpit-hq · cockpit
Medium6.9
CVE-2026-83535
Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison
Red Hat · Red Hat OpenStack Platform 18.0
High7.4