CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- apache camel, apache software foundation camel atmosphere websocket +1 moreApache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control header…7.5 High
- apache camel, apache software foundation camel vertx websocket +1 moreApache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control he…7.5 High
- apache camel, apache software foundation camel mail +1 moreApache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parameters3.7 Low
- deepmyst mystiDeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exposure of resource5.3 Medium
- gitea open source git serverNotification API leaks private issue metadata after access revocation7.5 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability6.5 Medium
- gitea open source git serverGitea private organization labels are visible to unauthorized users7.5 High
- gitea open source git serverGitea fork synchronization can expose private parent repository data7.5 High
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the…8.5 High
- gravitlauncher launcherGravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler9.8 Critical
- nuxt uiNuxt UI: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration5.3 Medium
- froxlorFroxlor before 2.3.7 Information Disclosure via customer_email.php5.3 Medium
- dragonflyoss dragonflyDragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth2.9 Low
- kerberos-io agentKerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect6.9 Medium
- craftcms cmsCraft CMS: Sensitive File Disclosure / Server-Side File Read6.0 Medium
- openclawOpenClaw < 2026.6.5 Authorization Header Forwarding via SSE6.0 Medium
oras.land/oras-go/v2GoORAS Go forwards registry credentials across registry redirects6.9 Medium- surrealdbSurrealDB before 3.1.0 Permission Bypass via Graph Traversal7.1 High
- repomixRepomix: attach_packed_output can bypass file-read secret scanning for supported local files6.8 Medium
- imagemagickImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged5.3 Medium
- mediawiki$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces0.0 None
- wikimedia foundation abusefilter, mediawiki +1 moreQueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI5.3 Medium
- mediawiki"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted5.3 Medium
- mediawikiUsers API leaks whether privileged users have their user groups disabled for lack of 2FA2.1 Low
- mediawikiAPI identification of users on private wikis5.1 Medium
- rilwis slim seo – a fast & automated seo plugin for wordpressSlim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter4.3 Medium
- google chromeInappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed...6.5 Medium
- google chromeInappropriate implementation in Views in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed...5.9 Medium
- google chromeInappropriate implementation in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote...5.3 Medium
- google chromeInappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in Input in Google Chrome on Linux prior to 150.0.7871.47 allowed a...6.5 Medium
- electron builder-util-runtime, electron-builder +1 moreelectron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`8.2 High
- cap-go capgoCapgo - Information Disclosure via /private/validate_password_compliance Endpoint6.9 Medium
- cap-go capgoCapgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions8.7 High
- ibm infosphere information serverIBM DataStage Flow Designer application is affected by an information disclosure vulnerability3.5 Low
github.com/fission/fissionGoFission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec8.1 High- advantech hospital queuing managementAdvantech｜Hospital Queuing Management - Sensitive Data Exposure8.7 High
- nezhahq nezhaNezha Monitoring: DDNS and Notification credential exposure via unredacted list API6.9 Medium
web-auth/webauthn-symfony-bundlePackagistWebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs6.6 Medium- kestraKestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)7.7 High
- rustfsRustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials8.2 High
- opf openprojectOpenProject: Private work package data disclosure through single meeting agenda item API4.3 Medium
- opf openprojectOpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects6.5 Medium
- opf openprojectOpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks7.5 High
- fluent fluentdFluentd: Exposure of Sensitive Information via Monitor Agent API7.5 High
- containers podmanPodman: Malformed Image can trick podman run into leaking host environment variables into the container7.5 High
- pnpmpnpm: Repository config can expand victim environment secrets into registry requests before scripts run6.5 Medium
- pnpmpnpm binds unscoped user-level npm auth credentials to a repository-selected registry6.9 Medium
- Show moreLoading…