CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- xenforoXenForo Local Account Page Caching Information Disclosure6.9 Medium
- sagedpw sage dpwA non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic...5.9 Medium
- openclawOpenClaw < 2026.3.28 - Environment Variable Disclosure via jq $ENV Filter Bypass7.1 High
- discourseDiscourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint5.3 Medium
- discourseDiscourse: Authorization bypass in oneboxer via user-controlled category id4.3 Medium
- discourseDiscourse: Missing post-level authorization allows whisper metadata disclosure5.3 Medium
- discourseDiscourse: Unauthorized channel membership inference via excluded_memberships_channel_id4.3 Medium
- discourseDiscourse: Admin-only report can be exported by moderators5.3 Medium
- discoursediscourse-subscriptions plugin leaking stripe API key in multisite environment2.0 Low
- rocketgenius gravity smtpGravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API7.5 High
- zte zxhn h188a firmwareUnauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and...7.1 High
- theunwindai awesome llm appsA cross-session information disclosure vulnerability exists in the awesome-llm-apps project in...8.2 High
- avideoAVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php8.7 High
- parse-community parse-serverParse Server: Auth data exposed via verify password endpoint8.2 High
- promtengineer localgptPromtEngineer localGPT Web api_server.py handle_index information disclosure6.9 Medium
- wandb openuiwandb OpenUI APIStatusError server.py generic_exception_handler information exposure5.1 Medium
- kstover ninja forms – the contact form builder that grows with youNinja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token6.5 Medium
- danny-avila librechatLibreChat's MCP Server Header Injection Enables OAuth Token Theft6.8 Medium
- dgtlmoon changedetection.io, webtechnologies changedetection +1 moreChangedetection.io Discloses Environment Variables via jq env Builtin in Include Filters8.3 High
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 moreUnauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow8.1 High
- openbmb xagentOpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file5.1 Medium
- grafana, red hat enterprise linux 10, enterprise linux 10.0 extended update support +3 more +5 morePublic dashboards discloses all direct mode datasources6.5 Medium
- yhirose cpp-httplibcpp-httplib Client Leaks Authentication Credentials to Untrusted Hosts on Cross-Origin HTTP Redirect7.4 High
- dovecot, open-xchange gmbh ox dovecot pro +1 moreDovecot has provided a script to use for attachment to text conversion. This script unsafely...4.3 Medium
apollo-routercrates.ioApollo Router Core: Browser Bug Enables Bypass of XS-Search Prevention via Read-Only Cross-Site Request Forgery6.3 Medium@apollo/servernpm,apollo-server-corenpm,@rootio/apollo__serverRoot +1 more +3 moreApollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention6.3 Medium- openclawOpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway Snapshots7.1 High
- drupal file (field) paths, deciphered filefield paths +1 moreInformation disclosure via file URI overwrite in File (Field) Paths6.9 Medium
- statamic cms, statamic +1 moreStatamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields6.5 Medium
- statamic cms, statamic +1 moreStatamic's Markdown preview endpoint exposes sensitive user data6.5 Medium
- wwbn avideoAVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings5.3 Medium
- craftcms cmsCraft CMS - Authorization Bypass in assets/preview-file Endpoint5.3 Medium
- hcl aftermarket dpc, hcltech aftermarket cloud +1 moreHCL Aftermarket DPC is affected by File Discovery6.5 Medium
- hcl aftermarket dpc, hcltech aftermarket cloud +1 moreHCL Aftermarket DPC is affected by Banner Disclosure vulnerability3.1 Low
- hcl aftermarket dpc, hcltech aftermarket cloud +1 moreHCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability3.1 Low
- enter software iperius backupEnter Software Iperius Backup NTLM2 information disclosure2.0 Low
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a privilege escalation vulnerability6.5 Medium
- apple ipados, macos, tvos +4 more +6 moreA privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.7.7 and...6.5 Medium
- apple macosThis issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. An app...5.3 Medium
- apple ipados, macos, visionos +3 more +5 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.5 Medium
- parse-community parse-serverParse Server: Auth data exposed via /users/me endpoint7.1 High
- craftcms cms, craft cms +1 moreCraft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users1.3 Low
- go-vikunja vikunjaWebhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API6.5 Medium
- ixray-team ixray-1.6-stcopInformation disclosure in ixray-1.6-stcop5.3 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Widget: Cocoa component7.5 High
- census cswebCensus CSWeb leaked configuration files9.3 Critical
- blinkoBlinko: Unauthorized User Information Leak6.9 Medium
- putyourlightson craft-sprigSprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground5.5 Medium
- kingaddons king addons for elementor – 80+ elementor widgets, 4 000+ elementor templates, woocommerce, mega menu, popup builderKing Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure5.3 Medium
- discourseDiscourse exposes ip_address of flagged user3.5 Low
- Show moreLoading…