CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- jonathanwilbur asn1-tsASN.1 TypeScript Library: Decoding an INTEGER could leak the underlying ArrayBuffer9.2 Critical
- foswikiFoswiki Changes/Viewfile/Oops information disclosure6.9 Medium
- getsimple-ce getsimple cms, getsimplecms-ce +1 moreUnauthenticated Information Disclosure via .htaccess Reliance in Sensitive Directories8.7 High
- hp inc samsung multixpress sl-k7400lxr, sl-k7500lxr, sl-k7600lxr, samsung multixpress sl-x7600lxr, sl-x7500lxr, sl-x7400lxr, sl-k4255rx, sl-k4305lx, sl-k4355lx +1 more +3 moreCertain Samsung MultiXpress Multifunction Printers Firmware – Potential Information Disclosure5.3 Medium
- windmillWindmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members2.7 Low
- openclawOpenClaw File Existence tools.exec.safeBins information exposure4.8 Medium
- feathersjs feathersFeathers exposes internal headers via unencrypted session cookie8.2 High
- accessibe web accessibility by accessibeWeb Accessibility by accessiBe <= 2.11 - Unauthenticated Sensitive Information Exposure5.3 Medium
- splunk, splunk enterprise +1 moreImproper Access Control in Splunk Monitoring Console App4.3 Medium
- splunk, splunk cloud platform, enterprise +2 moreRisky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise3.5 Low
- jenkinsJenkins has a build information disclosure vulnerability through Run Parameter4.3 Medium
- soflyy wp all export – drag & drop export to any custom csv, xml & excelWP All Export <= 1.4.14 - Unauthenticated Sensitive Information Exposure via PHP Type Juggling3.7 Low
- postmagthemes context blogContext Blog <= 1.2.5 - Unauthenticated Private Post Disclosure5.3 Medium
- openclawOpenClaw skills.status could leak secrets to operator.read clients5.3 Medium
- hewlett packard enterprise (hpe) hpe aruba networking private 5g core, hpe aruba networking private 5g core +1 moreUnauthenticated Information Disclosure in application API allows sensitive system information exposure6.5 Medium
- running-elephant datartAn information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to...5.7 Medium
- mattermost, mattermost server +1 moreUser profile update exposes password hash and MFA secrets5.7 Medium
- ritwickdey live serverAn issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files...4.3 Medium
- kasuga16 stickeasy protected contact formStickEasy Protected Contact Form <= 1.0.1 - Unauthenticated Information Disclosure5.3 Medium
- idno knownKnown affected by Account Takeover via Password Reset Token Leakage9.8 Critical
- thecfu scraparrScraparr Readarr Integration exposes sensitive values as metric labels.9.1 Critical
- grafana, grafana grafana/grafana, grafana/grafana-enterprise +2 morePublic Dashboards time range restriction on annotations can be bypassed5.3 Medium
- apple macosA privacy issue was addressed by moving sensitive data to a protected location. This issue is...5.5 Medium
- apple macosA privacy issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4,...5.5 Medium
- apple ipados, ios and ipados, iphone os +2 moreA privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.3 and...4.6 Medium
- apple macosA permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS...5.5 Medium
- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...4.6 Medium
- apple macosA logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia...5.5 Medium
- apple ipados, ios and ipados, iphone os +2 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.5 Medium
- apple macosA privacy issue was addressed with improved private data redaction for log entries. This issue is...3.3 Low
- apple ipados, macos, ios and ipados +1 more +3 moreThe issue was addressed with additional restrictions on the observability of app states. This...6.5 Medium
- apple ipados, ios and ipados, iphone os +2 moreA logic issue was addressed with improved state management. This issue is fixed in iOS 26.3 and...5.3 Medium
- apple ipados, macos, tvos +4 more +6 moreA privacy issue was addressed with improved checks. This issue is fixed in watchOS 26.3, tvOS 26...7.1 High
- apple macosThis issue was addressed with improved data protection. This issue is fixed in macOS Tahoe 26.3....5.5 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreThis issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26.3...7.1 High
- google keras, red hat openshift ai (rhoai) +1 moreArbitrary File Read in Keras via HDF5 External Datasets7.1 High
- google chromeInappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a...6.5 Medium
- pion dtlsPion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication key5.9 Medium
- wpzoom addons for elementor – starter templates & widgetsWPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.2 - Unauthenticated Protected Post Exposure via ajax_post_grid_load_more5.3 Medium
- statping-ngAn issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted...7.5 High
- statping-ngAn issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted...5.3 Medium
- statping-ngAn issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted...5.3 Medium
- statping-ngAn issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted...7.5 High
- microsoft office, outlook, 365 apps +10 more +12 moreMicrosoft Outlook Spoofing Vulnerability7.5 High
- fortinet fortiosAn Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200]...5.3 Medium
- kstover ninja forms – the contact form builder that grows with youNinja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action7.5 High
- apache airflowApache Airflow: Assigning single DAG permission leaked all DAGs Import Errors6.5 Medium
- tenda ac21, ac21 firmware +1 moreTenda AC21 Web Management DownloadFlash information disclosure6.9 Medium
- tenda ac21, ac21 firmware +1 moreTenda AC21 Web Management DownloadLog information disclosure6.9 Medium
- wekanWeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure6.9 Medium
- Show moreLoading…