CVE-2026-72699: Grav Login Email Enumerationcve-2026-72699-grav-login-email-enumeration
Directly returning an EMAIL_NOT_AVAILABLE error during registration when an email already exists enables account enumeration.
Explore
Rule Explorer
Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
- Public rules
- 4797
- Downloads
- 12.1M
- Verified
- 4797
- Authors
- 2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
CVE-2026-33877: Password Reset Timing Side Channel User Enumerationcve-2026-33877-password-reset-timing-side-channel-user-enumeration
The password reset / account recovery handler awaits an artificial delay only on the "user not found" / "no email" branches and returns early, while the success path (email sent) returns without an equivalent delay. This timing differential is observable by an unauthenticated attacker and enables username/email enumeration (CWE-208 / CWE-204). Pad all branch
CVE-2024-28232: Username Enumeration Distinct Errorscve-2024-28232-username-enumeration-distinct-errors
Authentication endpoint returns different error messages depending on whether the user exists or the password is incorrect. This discrepancy allows attackers to enumerate valid usernames. To fix, return a generic error instead.
All matching rules loaded.