CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- langflowLangflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak9.3 Critical
- anthropic claude code, anthropics claude-code +1 moreClaude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch6.0 Medium
- vllmvLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow5.3 Medium
- apache dolphinschedulerApache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.6.5 Medium
- n8nn8n: SecurityScorecard Node Leaks API Token to User-Controlled Host7.1 High
- n8nn8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints8.9 High
- crawl4aiCrawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution8.8 High
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA...3.2 Low
- oracle jd edwards enterpriseone toolsVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web...9.3 Critical
- oracle jd edwards enterpriseone toolsVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component:...9.1 Critical
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ...3.2 Low
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA...3.2 Low
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA...3.2 Low
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...5.3 Medium
- devolutions serverImproper access control in the social login connection endpoint in Devolutions Server 2026.2.5...4.3 Medium
- openclawOpenClaw < 2026.5.12 - Custom Header Leakage via MCP Streamable HTTP Cross-Origin Redirects6.0 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Password Manager component4.3 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure, sandbox escape in the Security: Process Sandboxing component4.7 Medium
- @clerk nuxtNuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo5.3 Medium
- @clerk nuxtNuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux6.8 Medium
- tornadoweb tornadoTornado before 6.5.7 Credential Leak via Handle Reuse8.2 High
- aio-libs aiohttpAIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges6.3 Medium
- angularAngular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker8.3 High
- vitejs vite, voidzero vite\+ +1 moreVite: `server.fs.deny` bypass on Windows alternate paths8.2 High
- babelBabel: Arbitrary File Read via sourceMappingURL Comment in @babel/core3.2 Low
- angularAngular: Request Credential & Cache Policy Stripping in Angular Service Worker5.7 Medium
- angularAngular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities5.7 Medium
- unknown wp go maps, wp go maps (formerly wp google maps) go maps +1 moreWP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback5.3 Medium
- hkuds ai-traderHKUDS AI-Trader Research Export agents.csv information disclosure6.9 Medium
- No product listedAn information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search...7.5 High
- No product listedAn issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain...7.5 High
- grafana operatorOperator - Namespaced User Path Traversal6.4 Medium
- tornadoweb tornadoTornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient7.7 High
- openclawOpenClaw < 2026.5.18 - Arbitrary File Read via Shell Expansion in system.run Safe-bin Allowlist7.6 High
- fleetdm fleetFleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint6.5 Medium
- fleetdm fleetFleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint6.5 Medium
- mispMISP AuthKey edit endpoint allows authenticated user email enumeration5.3 Medium
- discourseDiscourse: Don't leak restricted tag group names via tag info5.3 Medium
- discourseDiscourse: Prevent webhook payload disclosure on event redelivery4.3 Medium
- discourseDiscourse: Chat misauthorization and information disclosure5.3 Medium
- discourseDiscourse: Hidden reply-to post raw can be disclosed through AI explain prompts4.3 Medium
- discourseDiscourse: Non-staff group owners can see email password in plaintext through group history6.5 Medium
- discourseDiscourse: GroupPostSerializer leaks hidden full names through reaction post association4.3 Medium
- discourseDiscourse: Category queue reviewers can read raw incoming emails from queued posts4.3 Medium
- discourseDiscourse: Bot debug endpoints disclose whisper translation audit logs4.3 Medium
- discourseDiscourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users7.5 High
- parse-community parse-serverParse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied5.9 Medium
- mattermost, mattermost server +1 morePlugin bot username conflict allows user account to be used as bot identity in Mattermost Server5.3 Medium
- mattermost, mattermost server +1 moreMattermost fails to scope role_updated websocket events to authorized team and channel members4.3 Medium
- nettyNetty QUIC stateless reset token material exposed through header-visible connection IDs4.8 Medium
- Show moreLoading…