CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- elated-themes frappeFrappe: DB Schema Enumeration via Frappe-Authorization-Source6.9 Medium
- @clerk nuxtNuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher8.8 High
- @clerk nuxt, nuxt nuxt\/rspack-builder, nuxt\/webpack-builder +2 more@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)5.9 Medium
- yt-dlpyt-dlp: File Downloader cookie leak with curl6.1 Medium
- openclawOpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions7.1 High
- openclawOpenClaw < 2026.5.20 - Privilege Escalation via Hook-Triggered CLI MCP Tool Authority8.7 High
- duck-organization quest-botQuest Bot: Ticket transcripts can disclose private ticket contents to a lower-visibility channel5.7 Medium
- duck-organization quest-botQuest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channel5.7 Medium
- basekick-labs arcArc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS8.8 High
- hapijs wreck@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects6.5 Medium
- element-hq element-callElement Call reports full URLs of visited pages to analytics server8.6 High
- cerebrateCerebrate self-registration password hash exposure via inbox and audit log views5.1 Medium
- anthropics claude-code-actionClaude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration5.3 Medium
- open-telemetry opentelemetry-operatorOpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth7.7 High
- erlang otp, erlang\/otp, erlang\/ssh +2 moreSFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured2.3 Low
- nezhahq nezhaNezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data5.3 Medium
- espressif esp-idfESF-IDF: Out-of-Bounds Read in ESP-TEE Secure Service Wrappers7.1 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreWindows Push Notification Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreWindows Push Notification Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Push Notification Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Hyper-V Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 moreWindows Shell Information Disclosure Vulnerability6.5 Medium
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +12 more +14 moreWindows Shell Information Disclosure Vulnerability5.5 Medium
- microsoft visual studio codeVisual Studio Code Information Disclosure Vulnerability6.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreWindows Application Identity (AppID) Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 11 version 22h2, windows server 2012 +10 more +12 moreWindows NTLM Spoofing Vulnerability6.5 Medium
- netgear rbe970, rbe970 firmware, rbr350 +7 more +9 moreA Sensitive Information Disclosure Vulnerability in NETGEAR Orbi Satellites4.2 Medium
- typo3 cmsTYPO3 CMS - Broken Access Control in Media Module7.1 High
- typo3 cmsTYPO3 CMS - Broken Access Control in Clipboard5.3 Medium
- revolution slider slider revolutionSlider Revolution 7.0 - 7.0.10 - Authenticated (Subscriber+) Sensitive Information Disclosure6.5 Medium
- apache answerApache Answer: Unlisted Questions Accessible via Direct API Access6.5 Medium
- huawei harmonyosPermission control vulnerability in the file preview module. Impact: Successful exploitation of...5.5 Medium
- No product listedAn information disclosure vulnerability in the /api/v1/user/info endpoint of AgentChat v2.3.0...7.5 High
- basekick-labs arcArc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks7.1 High
- No product listedJeecgBoot User List Endpoint SysUserController.java queryPageList information disclosure2.3 Low
- secureage catchpulseSecureAge CatchPulse IOCTL saappctl.sys information disclosure4.8 Medium
- erzhongxmu jeewmserzhongxmu JeeWMS Boot Actuator Endpoint actuator information disclosure6.9 Medium
- altium 365, enterprise server +1 morePath Traversal in Altium Projects Service Allows Arbitrary File Read8.3 High
- altium 365, enterprise server +1 moreServer-Side Request Forgery in Altium Platform Design GraphQL Service Allows Information Disclosure8.3 High
- shopperdotcom shopperShopper: Multiple data integrity and disclosure issues in admin Livewire components8.7 High
- nocodbNocoDB: Plaintext Password Comparison in Shared Views6.9 Medium
- siderolabs omniOmni: Reader-level users can retrieve imported cluster CA keys via ResourceService7.6 High
- imagemagickImageMagick: Policy Bypass can read disallowed files5.5 Medium
- google chromeInappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a...6.5 Medium
- google chromeInappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a...6.5 Medium
- google chromeInappropriate implementation in GPU in Google Chrome on Mac prior to 149.0.7827.53 allowed a...6.5 Medium
- google chromeInappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a...6.5 Medium
- google chromeInappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote...4.3 Medium
- Show moreLoading…