CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInappropriate implementation in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote...4.3 Medium
- devspaceDevSpace UI Server WebSocket CheckOrigin does not validate source7.7 High
- flowiseai flowiseFlowiseAI Flowise Endpoint account.service.ts verify information disclosure6.3 Medium
- hcl bigfix service management (sm), hcltech bigfix service management +1 moreHCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified.2.6 Low
- hcl bigfix service management (sm), hcltech bigfix service management +1 moreHCL BigFix Service Management (SM) is affected by use of a vulnerable component4.6 Medium
- hcl software bigfix service management (sm), hcltech bigfix service management +1 moreHCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials4.8 Medium
- hcl software bigfix service management (sm), hcltech bigfix service management +1 moreHCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directl3.7 Low
- hcl bigfix service management (sm), hcltech bigfix service management +1 moreHCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header3.7 Low
- flowiseai flowiseFlowiseAI Flowise API Response account.service.ts login information disclosure6.3 Medium
- apache wicketApache Wicket: crafted URLs can bypass PackageResourceGuard7.5 High
- No product listedSensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6...7.5 High
- wwbn avideoWWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization7.7 High
- gitoxidelabs gitoxidegitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass8.7 High
- inngest, inngest inngest-js +1 moreInngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods8.6 High
- wpkube subscribe to comments reloadedSubscribe To Comments Reloaded <= 240119 - Improper Authorization to Unauthenticated Arbitrary Subscription Management6.5 Medium
- No product listedThe rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through...7.7 High
- quarkiverse quarkus-openapi-generatorquarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations6.3 Medium
- openclawOpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec Allowlist8.7 High
- 0xjacky nginx-ui, nginxui nginx ui +1 morenginx-ui: Settings API Exposes Protected Secrets6.5 Medium
- 0xjacky nginx-ui, nginxui nginx ui +1 morenginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback6.5 Medium
- titraio titraGlobal Settings Publication Exposes Sensitive Configuration to Any Authenticated User in Titra6.5 Medium
- prometheus, red hat custom metric autoscaler operator for red hat openshift, file integrity operator +52 more +54 morePrometheus Azure AD remote write OAuth client secret exposed via config API7.5 High
- dokaninc dokan: ai powered woocommerce multivendor marketplace solution – build your own amazon, ebay, etsyDokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint5.3 Medium
- trustindex widgets for social photo feedWidgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints6.5 Medium
- argoproj argo cd, argo-cd, red hat openshift data foundation 4 +3 more +5 moreArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction9.6 Critical
- argoproj argo cd, red hat openshift data foundation 4, openshift gitops +2 moreIn Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext...7.7 High
- absolute secure accessFormat string vulnerability in MacOS clients prior to 14.504.8 Medium
- meware software development inc. pdksInformation Disclosure in MeWare Software's PDKS6.5 Medium
- miyagawa plack::middleware::xsendfile, plack\ +1 morePlack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting9.1 Critical
- admidioAdmidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment2.7 Low
- openclawOpenClaw < 2026.4.15 - Arbitrary Local File Read via Webchat Audio Embedding6.3 Medium
- curlnetrc credential leak with reused proxy connection5.3 Medium
- gofiber fibergithub.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters6.5 Medium
- codeastro online job portalCodeAstro Online Job Portal user-cvs file information disclosure6.9 Medium
- 666ghj mirofish666ghj MiroFish Werkzeug Debugger PIN console information disclosure6.3 Medium
- smythos sreSmythOS sre Connector Service utils.ts information disclosure5.1 Medium
- ciliumCillium exposes sensitive information included in the cilium-bugtool debug archive7.9 High
- google gemini-cli, run-gemini-cli, google cloud gemini cli +1 more +3 moreUnauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows10.0 Critical
- openprinting cupsOpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users4.3 Medium
- dgraphUnauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph9.8 Critical
- microsoft azure iot centralAzure IoT Central Elevation of Privilege Vulnerability9.9 Critical
- postcssPostCSS has XSS via Unescaped </style> in its CSS Stringify Output6.1 Medium
- unknown ht mega addons for elementorHT Mega < 3.0.7 – Unauthenticated PII Disclosure5.3 Medium
- primisdigital table managerTable Manager <= 1.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute4.3 Medium
- tanium threat responseTanium addressed an information disclosure vulnerability in Threat Response.2.7 Low
- oracle mysql, oracle corporation mysql shell +1 moreVulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). ...5.8 Medium
- oracle financial services analytical applications infrastructureVulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of...6.5 Medium
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web...7.5 High
- oracle peoplesoft enterprise fin contractsVulnerability in the PeopleSoft Enterprise FIN Contracts product of Oracle PeopleSoft (component:...6.5 Medium
- oracle hcm common architectureVulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component...7.5 High
- Show moreLoading…