CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- jfrog artifactoryPrivilege escalation via JFrog Worker event token exposure8.8 High
- honeywell s35 series 3m/5m/8m/pinhole camerasAudit Log Exposure through Unauthorized Access6.9 Medium
- unknown quiz and survey master (qsm)Quiz And Survey Master < 11.1.3 - Unauthenticated User Enumeration and Password Oracle via Quiz Login5.3 Medium
- No product listedAn issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the...7.5 High
- mf-yang openclaw-cnmf-yang openclaw-cn Scheme navigation-guard.ts assertBrowserNavigationAllowed information disclosure5.3 Medium
- ericcornelissen shescapeShescape: Home-directory disclosure in assignment context on Unix with Dash6.3 Medium
- openlistteam openlistOpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search4.3 Medium
hubuum_clientcrates.ioHubuum client library (Rust): Authenticated requests may escape the configured base path through redirects6.3 Medium- gitpython-developers gitpythonGitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()8.7 High
- budibaseBudibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders5.7 Medium
- budibaseBudibase: Unauthenticated user information disclosure via public tenant user lookup endpoint7.5 High
- budibaseBudibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))9.0 Critical
- budibaseBudibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users4.9 Medium
- cloudreveCloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicate4.3 Medium
- loytec lweb-802Loytec LWEB802: Exposure of Sensitive Information in browser localStorage7.7 High
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.6 +3 more +5 moreKeycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api5.5 Medium
- microsoft graphMicrosoft Graph Information Disclosure Vulnerability6.5 Medium
- joomshaper.com easy store extension for joomlaJoomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.19.2 Critical
- postcssPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments7.5 High
- tassos.gr convert forms extension for joomlaJoomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.28.2 High
- regularlabs.com cache cleaner pro extension for joomlaJoomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension9.8 Critical
- regularlabs.com geoip extension for joomlaJoomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension7.5 High
- oracle platform security for javaVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware ...8.0 High
- n8nn8n before 1.123.67 Arbitrary File Read via Send Email Node8.2 High
- dell powerprotect data managerDell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sensitive...6.0 Medium
- hikvision ds-2cd series, ds-2de series +1 moreThere is a information disclosure vulnerability in some Hikvision cameras, allowing...5.3 Medium
- gitpython-developers gitpythonGitPython before 3.1.52 Environment Variable Exfiltration via clone_from8.7 High
- gitea open source git serverWebhook Authorization Header Returned in Plaintext via API2.7 Low
- gitea open source git serverCross-Repo Information Disclosure via Org-Level Actions Run/Job APIs6.5 Medium
- gitea open source git serverGHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private4.3 Medium
- gitea open source git serverPrivate org member list leaked via /members API endpoint — incomplete fix for PR #381457.5 High
- oracle corporation hrms (uk), oracle human resources management system +1 moreVulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll)....7.7 High
- oracle corporation hrms (us), oracle human resources management system +1 moreVulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll...7.1 High
- oracle corporation hrms (norway), oracle human resources management system +1 moreVulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal...7.7 High
- oracle corporation hrms (us), oracle human resources management system +1 moreVulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal...6.8 Medium
- oracle corporation hrms (us), oracle human resources management system +1 moreVulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal...6.5 Medium
- oracle corporation hcm configuration workbench, oracle human capital management configuration workbench +1 moreVulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite ...6.3 Medium
- oracle learning managementVulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component:...6.3 Medium
- oracle qualityVulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Quality...6.3 Medium
- oracle corporation hrms (us), oracle human resources management system +1 moreVulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll -...6.3 Medium
- oracle e-business suite, succession planning +1 moreVulnerability in the Oracle Succession planning product of Oracle E-Business Suite (component:...6.3 Medium
- oracle e-business suite, oracle corporation production scheduling +1 moreVulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component:...7.6 High
- oracle e-business suite, oracle corporation contracts integration +1 moreVulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component:...5.3 Medium
- oracle installed baseVulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create...8.3 High
- oracle self-service human resourcesVulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite ...6.5 Medium
- oracle corporation hrms (uk), oracle human resources management system +1 moreVulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal...6.3 Medium
- oracle e-business suite, oracle corporation edi gateway +1 moreVulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI). ...4.3 Medium
- oracle e-business suite, oracle corporation edi gateway +1 moreVulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI). ...4.3 Medium
- oracle price protectionVulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component:...6.3 Medium
- oracle e-business suite, oracle corporation edi gateway +1 moreVulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: Internal...1.9 Low
- Show moreLoading…