CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- discourseDiscourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check5.3 Medium
- discourseDiscourse hasUnauthorized Exposure of Private User Action Types5.3 Medium
- openvessl anchorrAnchorr: Stored XSS in User Mapping dropdown allows unprivileged Discord users to exfiltrate all secrets via /api/config9.7 Critical
- suitecrm, suitecrm suitecrm-core +1 moreAuthenticated SuiteCRM Users Can Retrieve The Password Hash of Any User6.5 Medium
- discourseDiscourse leaks PM post edits to moderators2.7 Low
- discourseDiscourse filters whisper posts from private-posts feed6.5 Medium
- discourseDiscourse prevents hidden profile data leak via user onebox4.3 Medium
- microsoft azure data factoryAzure Data Factory Information Disclosure Vulnerability8.6 High
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve: Authenticated repo import can clone server-local private repositories7.1 High
- opexus ecase, ecomplaint, opexustech ecase ecomplaint +2 moreOPEXUS eComplaint and eCase insecure password reset9.2 Critical
- codename065 download managerDownload Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter4.3 Medium
- hapifhir org.hl7.fhir.core, red hat fuse 7 +1 moreHAPI FHIR HTTP authentication leak in redirects7.5 High
- parse-community parse-serverParse Server leaks protected fields via LiveQuery afterEvent trigger8.2 High
- jenkins loadninja, jenkins project loadninja plugin +1 moreJenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form4.3 Medium
- ibm planning analytics localIBM Planning Analytics Information Disclosure6.5 Medium
- wwbn avideoAVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php5.3 Medium
- getoutline outlineOutline's Information Disclosure in Activity Logs allows User Enumeration of Private Drafts4.3 Medium
- b3log siyuanSiYuan has an Arbitrary File Read in its Desktop Publish Service9.9 Critical
- ayacoo redirect tab, typo3 extension "redirect tabs" +1 moreBroken Access Control in extension "Redirect Tab"2.3 Low
- craftcms google-cloudGoogle Cloud Storage for Craft CMS has an Information Disclosure Vulnerability2.4 Low
- craftcms aws-s3Amazon S3 for Craft CMS has an Information Disclosure vulnerability6.9 Medium
- nicolargo glancesGlances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`9.1 Critical
- nicolargo glancesGlances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials7.5 High
- nicolargo glancesGlances exposes the REST API without authentication8.7 High
- hcl aionHCL AION is affected by a vulnerability where certain identifiers may be predictable in nature1.8 Low
- mattermost, mattermost ms teams +1 moreMS Teams plugin sensitive config values not properly masked in support packets7.6 High
- No product listedmyAEDES App aedes.me.beta EngageBayUtils.java information disclosure2.0 Low
- gvectors wpdiscuzwpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext6.9 Medium
- shopware commercialshopware/commercial: `/api/_info/config` route exposes information about licenses5.3 Medium
- swag platform-securityswag/platform-security: `/api/_info/config` route exposes information about licenses and active security fixes5.3 Medium
- @tinacms cli, ssw tinacms\/cli +1 moreArbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI6.2 Medium
- @backstage plugin-scaffolder-backend, linuxfoundation backstage\/plugin-scaffolder-backend +1 more@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint4.4 Medium
- parse-community parse-serverParse Server has a protected fields bypass via LiveQuery subscription WHERE clause6.9 Medium
- ericcornelissen shescapeShescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash6.9 Medium
- splunk, splunk cloud platform, enterprise +2 moreSensitive Information Disclosure in Discover Splunk Observability Cloud app for Splunk Enterprise5.4 Medium
- splunk, splunk cloud platform, enterprise +2 moreSensitive Information Disclosure through Improper Access Control in Splunk Enterprise6.5 Medium
- argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +1 more +3 moreArgo Workflows has unauthorized access to Argo Workflows Template9.8 Critical
- unknown guest posting / frontend posting / front editorWP Front User Submit < 5.0.6 - Unauthenticated Sensitive Information Exposure5.9 Medium
- istio, red hat cert-manager operator for red hat openshift, externaldns operator +10 more +12 moreIstio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.8.7 High
- git-for-windows gitGit for Windows leaks NTLM hash when cloning from an attacker-controlled server7.4 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +27 more +29 moreWindows Accessibility Infrastructure (ATBroker.exe) Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +27 more +29 moreWindows Shell Link Processing Spoofing Vulnerability5.3 Medium
openclawnpmOpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage7.1 High- nicolargo glancesGlances Exposes Unauthenticated Configuration Secrets8.7 High
- filebrowserFileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info7.5 High
- lyc8503 uptimeflareUptimeFlare: Montior config / Credentials in `workerConfig` exposed in client-side JavaScript bundle7.5 High
- homarrHomarr: Unauthenticated Information Disclosure (Integration Metadata Leak)5.3 Medium
- bluewave-labs checkmateCheckmate: Unauthenticated Access to Unpublished Status Page5.3 Medium
- b3log siyuanSiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage9.3 Critical
- caddyserver caddyCaddy: vars_regexp double-expands user input, leaking env vars and files5.5 Medium
- Show moreLoading…