CVE-2026-54411Medium· 5.9▾ SunlitLinux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeate…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.5%
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73066High· 7.1Tesseract is an open source OCR engine
CVE-2026-49265Medium· 6.8OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+
CVE-2024-37371Medium· 6.5krb5: GSS message token handling (CVE-2024-37371)
CVE-2025-24898Medium· 4.8rust-openssl: rust openssl ssl::select_next_proto use after free (CVE-2025-24898)
CVE-2025-59432Medium· 6.8SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms
CVE-2026-63381Medium· 6.6Libevent is an event notification library