By weakness (CWE)

CWE-204: related vulnerabilities

CVEs classified under CWE-204. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

5 published vulnerabilities

• CVE-2026-45294MEDIUM 5.3

  FreeScout, a Laravel-based open-source help desk platform, leaks information about whether an email address is registered as a helpdesk agent account. An attacker can repeatedly submit email addresses to the password reset feature and observe different visual responses that reveal which accounts exist—a technique called user enumeration. This flaw affects all versions before 1.8.219 and requires no authentication or user interaction to exploit.

• CVE-2026-45620MEDIUM 5.3

  CVE-2026-45620 is a user enumeration vulnerability in WWBN AVideo version 29.0 and earlier. The `objects/mention.json.php` endpoint lacks proper authentication controls and allows attackers to discover valid usernames on the platform without logging in. An attacker can craft requests to the endpoint and enumerate users by checking responses, potentially gathering intelligence for follow-up attacks like credential stuffing or targeted social engineering.

• CVE-2026-53947MEDIUM 5.3

  Ghost, a Node.js-based content management system, contains a vulnerability in its member signin endpoints that allows an unauthenticated attacker to discover whether an email address belongs to a registered member of a Ghost site. The flaw stems from inconsistent response patterns when valid versus invalid member emails are submitted, enabling email enumeration attacks. Versions 5.18.0 through 6.21.0 are affected; the issue is resolved in version 6.21.1.

• CVE-2026-53422MEDIUM 4.3

  A flaw in Erlang OTP's SFTP server module allows authenticated users to discover whether files and directories exist outside their authorized access area. When a user sends a specially crafted request to the server's path-resolution function, the server's response reveals whether a path exists on the system—even if the user shouldn't have permission to see that location. An attacker can use this to map out sensitive filesystem structures, such as identifying the presence of critical files or system directories, without actually reading any contents. This is an information-disclosure issue that requires valid SFTP credentials to exploit.

• CVE-2026-53908MEDIUM 4.3

  MCO (MyComplianceOffice) contains a user enumeration vulnerability in its authentication workflows. When users attempt to reset passwords or retrieve usernames, the application responds differently depending on whether an account exists. An attacker with login access can exploit these timing or content differences to systematically discover valid usernames and associated email addresses—useful for follow-up social engineering, credential stuffing, or targeted account takeover attempts. The vendor has not been successfully contacted to confirm scope beyond version 25.3.3.1.