CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 morefollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets6.9 Medium
- asynchttpclient async-http-clientAsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects6.8 Medium
- craftcms commerceCraft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments1.7 Low
- external-secrets external secrets operator, external-secrets +1 moreExternal Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine7.1 High
- code-projects simple chatboxcode-projects Simple ChatBox Endpoint chatbox.sql SimpleChatbox_PHP file information disclosure6.9 Medium
- mervinpraison praisonaiPraisonAI Exposes Sensitive Environment Variable via Untrusted MCP Subprocess Execution5.5 Medium
- code-projects online library management systemcode-projects Online Library Management System SQL Database Backup File library.sql information disclosure5.3 Medium
- altenar sportsbookCross Site Scripting vulnerability in Altenar Sportsbook Software Platform (SB2) v.2.0 allows a...6.1 Medium
- mervinpraison praisonaiPraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS5.3 Medium
gramps-webapiPyPIGramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users6.9 Medium- code-projects patient record management systemcode-projects Patient Record Management System SQL Database Backup File hcpms.sql information disclosure5.3 Medium
- hashicorp tooling, red hat openshift container platform 4, trusted artifact signer +1 more +3 moreGo-getter may allow to arbitrary filesystem reads through git operations7.5 High
- bytecodealliance wasmtimeWasmtime leaks host data with 64-bit tables and Winch2.3 Low
- apache dolphinschedulerApache DolphinScheduler: Users can access sensitive information through the actuator endpoint.7.5 High
- code-projects movie ticketing systemcode-projects Movie Ticketing System SQL Database Backup File moviedb.sql information disclosure5.3 Medium
- openfga, red hat multicluster global hub 1.7.0, advanced cluster management for kubernetes 2.14 +3 more +5 moreOpenFGA Playground Preshared Key Exposure6.5 Medium
- mervinpraison praisonaiPraisonAI has Unauthenticated SSE Event Stream Exposes All Agent Activity in A2U Server7.5 High
- harttle liquidjsLiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel5.3 Medium
- imprintnext riaxe product customizerRiaxe Product Customizer <= 2.4 - Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpoint5.3 Medium
litellmPyPILiteLLM: Password hash exposure and pass-the-hash authentication bypass8.6 High- makeplane planePlane Exposes User Email (PII and part of credential) in GET Parameter2.0 Low
- openclawOpenClaw < 2026.4.2 - Cleartext Credential Transmission via Unencrypted WebSocket Gateway Endpoints5.9 Medium
- openclawOpenClaw < 2026.4.2 - Information Disclosure via Gateway Connect Snapshot5.3 Medium
- runzero platformrunZero Platform API credential information leak2.7 Low
- vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +13 more +15 moreVite Affected by Arbitrary File Read via Vite Dev Server WebSocket8.2 High
- code-projects online fir systemcode-projects Online FIR System SQL Database Backup File complaints.sql sensitive information6.9 Medium
- code-projects online application system for admissioncode-projects Online Application System for Admission oas.sql sensitive information6.9 Medium
- No product listedAn information disclosure vulnerability exists in AZIOT 1 Node Smart Switch (16amp)- WiFi...4.6 Medium
- acrel electrical prepaid cloud platformAcrel Electrical Prepaid Cloud Platform Backup File bin.rar information disclosure6.9 Medium
- tencent ai-infra-guardTencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure6.9 Medium
- technostrobe hi-led-wr120-g2, hi-led-wr120-g2 firmware +1 moreTechnostrobe HI-LED-WR120-G2 Configuration Data fs information disclosure6.9 Medium
- wwbn avideoWWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php5.3 Medium
- wwbn avideoWWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php5.3 Medium
- directusDirectus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries8.1 High
- directusDirectus exposes sensitive fields in revision history6.5 Medium
- directusDirectus GraphQL Schema SDL Disclosure Setting5.3 Medium
- discourseDiscourse: Staged user custom fields are exposed on public invite pages2.7 Low
- discourseDiscourse: Hidden tag visibility bypass on tag routes6.3 Medium
- mediawiki checkuserSuggested investigations: Handle suppressed usernames4.8 Medium
- openclawOpenClaw < 2026.3.31 - Information Disclosure via Control UI Bootstrap JSON6.9 Medium
- openclawOpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass7.1 High
- newgen omnidocsNewgen OmniDocs GetWebApiConfiguration information disclosure6.3 Medium
- rack, red hat satellite 6 +1 moreRack: Local file inclusion in `Rack::Static` via URL Prefix Matching7.5 High
- signalk signal k server, signalk-server +1 moresignalk-server: Arbitrary Prototype Read via `from` Field Bypass2.1 Low
- boldgrid w3 total cacheW3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header7.5 High
- nhost, nhost nhost\/auth +1 moreNhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider Callback2.3 Low
- aio-libs aiohttpAIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect2.7 Low
- unknown export all urlsExport All URLs < 5.1 - Unauthenticated Sensitive Data Exposure5.3 Medium
- google chromeInappropriate implementation in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote...6.5 Medium
- foxit pdf editor, pdf reader +1 moreSelf-Modifications Affecting Altered Printing and Redaction in Foxit PDF Editor4.7 Medium
- Show moreLoading…