CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- wekanWekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens9.3 Critical
- wekanWekan Exposes All Global Webhook Integrations through globalwebhooks Publication8.7 High
- wekanWekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication6.9 Medium
- opensiftOpenSift: Sensitive implementation details exposed via raw exception messages and token-returning endpoints5.3 Medium
- wpsoul greenshift – animation and page builder blocksGreenshift – animation and page builder blocks <= 12.8.3 - Unauthenticated Sensitive Information Exposure via Settings Backup5.3 Medium
- flowiseFlowise - PII Disclosure via Unauthenticated Forgot Password Endpoint6.9 Medium
- makeplane planePlane: Unauthenticated Workspace Member Information Disclosure7.5 High
- doobidoo mcp-memory-servicemcp-memory-service: System Information Disclosure via Health Endpoint5.3 Medium
- olivetinOliveTin: View permission not being checked when returning dashboards6.5 Medium
- forceu gokapiGokapi: Data Leak in Upload Status Stream6.4 Medium
- yhirose cpp-httplibcpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header5.3 Medium
openclawnpmOpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection6.9 Medium- openclawOpenClaw < 2026.2.23 - Sandbox Boundary Bypass via Image Tool workspaceOnly Bypass6.0 Medium
- darkreaderDark Reader gives users the ability to request style sheets from local web servers3.4 Low
- s-sols seraphinite acceleratorSeraphinite Accelerator <= 2.28.14 - Authenticated (Subscriber+) Exposure of Sensitive Information to an Unauthorized Actor4.3 Medium
- seppmail secure email gateway, seppmail +1 morePGP Mixed Plaintext and Encrypted Content6.9 Medium
- unknown mail mintMail Mint < 1.19.5 - Unauthenticated Emails Disclosure7.5 High
- iqonicdesign wpbookitWPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure5.3 Medium
- open-emr openemrOpenEMR's payments gateway_api_key secret rendered into client JS code9.6 Critical
openclawnpmOpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs8.9 High- openclawOpenClaw Client PKCE Verifier Information Disclosure Vulnerability5.3 Medium
- openclawOpenClaw < 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message Actions7.1 High
- filebrowserFile Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory7.1 High
- icewhaletech zimaosZimaOS is vulnerable to Server-Side Request Forgery (SSRF)7.1 High
- google androidIn hasImage of Notification.java, there is a possible way to reveal information across users due...8.4 High
- google androidIn onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of...6.2 Medium
- google androidIn jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error...5.5 Medium
- google androidIn multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token...7.7 High
- gvectors wpforo forumwpForo Forum 2.4.14 Information Disclosure via Global RSS Feed6.9 Medium
- gradio-app gradioGradio has Open Redirect in OAuth Flow4.3 Medium
- efm-networks, inc. iptime ax2004m, iptime ax3000q, iptime ax6000m +5 more +7 moreExposure of Sensitive Information to an Unauthorized Actor vulnerability in EFM-Networks, Inc....6.0 Medium
- morelitea initiativeInitiative Allows Unauthenticated Access to Uploaded Documents via Public /uploads/ Endpoint7.5 High
- evershopEverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response9.8 Critical
- discourseDIscourse doesn't prevent whispers to leak in excerpts4.9 Medium
- weblateWeblate: Missing access control for the AddonViewSet API exposes all addon configurations4.3 Medium
- google cloud vertex ai workbenchSensitive Data Exposure in Google Cloud Vertex AI Workbench8.4 High
- fleetdm fleetFleet: Sensitive Google Calendar credentials disclosed to low-privileged users1.3 Low
- open-emr openemrOpenEMR has FHIR Patient Compartment Bypass in CareTeam Resource5.7 Medium
- cisco catalyst sd-wan managerA vulnerability in Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker...6.5 Medium
- gtsteffaniak filebrowser, filebrowser quantum +1 moreFileBrowser Quantum: Password Protection Not Enforced on Shared File Links7.1 High
- open-emr openemrOpenEMR's location resource for Group.$export operation returns entire patient/user population contact information4.5 Medium
- devolutions serverImproper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0...6.5 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure, mitigation bypass in the Settings UI component7.5 High
- apache supersetApache Superset: Sensitive Data Exposure via REST API (disabled by default)2.3 Low
- apache supersetApache Superset: SQLLab Read-Only Bypass on PostgreSQL7.1 High
- mozilla firefox, thunderbird +1 moreInformation disclosure due to JIT miscompilation in the JavaScript Engine: JIT component7.5 High
- fastapiadminFastApiAdmin Download Endpoint controller.py download_controller information disclosure5.3 Medium
- fastapiadminFastApiAdmin Custom Documentation Endpoint init_app.py reset_api_docs information disclosure6.9 Medium
- funadminfunadmin forget.html getMember information disclosure6.9 Medium
- bigbluebuttonBigBlueButton: Audio from participants to the server initially unmuted2.0 Low
- Show moreLoading…