CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- cap-go capgoCapgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function8.7 High
- postmagthemes context blogContext Blog <= 1.3.5 - Unauthenticated Sensitive Information Exposure via 'postID' Parameter5.3 Medium
- stylemix cost calculator builderCost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys5.3 Medium
- 2coders mux video uploaderMux Video Uploader <= 1.1.4 - Authenticated (Subscriber+) Information Exposure4.3 Medium
- supercleanse members – membership & user role editor pluginMembers <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel5.3 Medium
github.com/almeidapaulopt/tsdproxyGoTSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation9.0 Critical- gristlabs grist-coreGrist: Insufficient access control in the /forms endpoint exposes table metadata4.3 Medium
- exconExcon: redact additional sensitive/risky headers when following redirects6.5 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations8.7 High
- deloitte ai assist for customerDeloitte AI Assist for Customer information disclosure6.9 Medium
- caronc appriseApprise forwards configured auth headers across cross-origin HTTP redirects3.1 Low
- getgrav gravGrav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)6.5 Medium
- getgrav gravGrav before 2.0.2 Config Exfiltration via offsetGet Filter7.1 High
- mervinpraison praisonaiPraisonAI FastContext before 1.6.78 Path Traversal6.9 Medium
- mervinpraison praisonaiPraisonAI before 4.6.78 Path Traversal via ContextGatherer6.8 Medium
- mervinpraison praisonaiPraisonAI before 4.6.78 Unauthenticated SSRF via webhook_url6.9 Medium
- phpmyfaqphpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints6.9 Medium
- zhayujie cowagentzhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosure5.3 Medium
- discourseDiscourse: Private event sample invitees are serialized to non-invited event viewers5.3 Medium
- discourseDiscourse: Hidden post revisions leak through adjacent visible diffs5.3 Medium
- discourseDiscourse: Secure uploads exposed by hotlinked image copying6.3 Medium
- discourseDiscourse: Hidden tag names leaked via category serializers6.3 Medium
- hoppscotchHoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server7.5 High
- openwebui open webui, open-webui +1 moreOpen WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials6.0 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id7.7 High
- n8nn8n: Shared Credential Header Leak via HTTP Request Pagination Expression7.1 High
- enchant97 note-markNote Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark5.3 Medium
- No product listedUnauthorized use of Kyocera printers, allows all information stored in the Kyocera address book...7.5 High
- nl-portal nl.nl-portal:besluiten, nl.nl-portal:documenten-api +1 moreNL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries6.5 Medium
- guzzleGuzzle: Cookie Disclosure and Injection via IP-Address Domains4.7 Medium
- trustyai trustyai-service-operator, red hat openshift ai (rhoai) +1 moreTrustyai-service-operator: trustyai service operator: unauthenticated access to ai guardrails and orchestrator apis6.3 Medium
- cap-go capgoCapgo - EXIF Metadata Exposure in App Information Image Upload5.3 Medium
- cap-go capgoCapgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC6.9 Medium
- cap-go capgoCapgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC8.7 High
- zhenorzz goployGoploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise7.7 High
- zhenorzz goployGoploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare7.1 High
- hewlett packard enterprise (hpe) hpe networking instant onUnauthenticated Remote Disclosure of Cryptographic Secrets6.5 Medium
- apache airflowApache Airflow: Task-instance API exposes secrets in deferred trigger kwargs6.5 Medium
- apache airflowApache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key6.5 Medium
- apache airflowApache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target4.3 Medium
- apache airflowApache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options6.5 Medium
- fossbillingFOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint6.9 Medium
- fossbillingFOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints8.7 High
- fossbillingFOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data2.3 Low
- decolua 9router9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover9.9 Critical
- decolua 9router9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints8.7 High
- decolua 9router9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats9.3 Critical
- decolua 9router9Router 0.4.41 - Unauthenticated API Exposure via /api/providers9.3 Critical
- openai codex desktop app for macosThe OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses....6.5 Medium
- apache camel, apache software foundation camel iggy +1 moreApache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling cont…7.5 High
- Show moreLoading…