CWE-385

CVEs per yearBy the year they were published

1. 20185
2. 20191
3. 20202
4. 20213
5. 20224
6. 20232
7. 202410
8. 202510
9. 20266

Newest CVEs

• CVE-2026-84308

  phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

  phpseclib · phpseclib

  Medium6.3
• CVE-2026-55785

  free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

  free5gc · free5gc

  Low3.7
• CVE-2026-6478

  PostgreSQL discloses MD5-hashed passwords via covert timing channel

  PostgreSQL

  Medium6.5
• CVE-2026-5598

  Non-constant time comparisons risk private key leakage in FrodoKEM.

  Legion of the Bouncy Castle Inc. · BC-JAVA

  High8.9
• CVE-2025-69893

  A side-channel vulnerability exists in the implementation of BIP-39 mnemonic processing, as observed in Trezor One v1.13.0 to v1.14.0, Trezor T v1.13.0 to…

  Product not named

  Medium4.6
• CVE-2025-66442

  In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize…

  Product not named

  Medium5.1
• CVE-2025-59425

  vLLM vulnerable to timing attack at bearer auth

  vllm-project · vllm

  High7.5
• CVE-2025-9231

  Timing side-channel in SM2 algorithm on 64 bit ARM

  OpenSSL · OpenSSL

  Medium6.5
• CVE-2025-59432

  Timing Attack Vulnerability in SCRAM Authentication

  ongres · scram

  Medium6.6
• CVE-2025-49087

  In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS#7…

  Mbed · mbedtls

  Medium4.0

Vendors it comes up for most

1. Dell6
2. Red Hat4
3. [UNKNOWN]4
4. OpenSSL2
5. DavidOsipov1
6. Devolutions1
7. IBM1
8. Legion of the Bouncy Castle Inc.1
9. Mbed1
10. NodeJS1