CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- wso2 identity server, email otp authenticator, carbon abstract otp authenticator +2 more +4 moreInformation Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure4.3 Medium
- unknown gutenberg essential blocksEssential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint7.5 High
- unknown gutenberg essential blocksEssential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint7.5 High
- pixelite events managerEvents Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads7.5 High
- jordy meow ai engineAI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens6.5 Medium
- goodlayers tourmasterTourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export5.3 Medium
- pepro dev. group peprodev woocommerce receipt uploaderPeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR5.3 Medium
- netease-youdao lobsterainetease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure5.3 Medium
- heshengtao super-agent-partyheshengtao super-agent-party execute_tool_manually Endpoint server.py get_file_content information disclosure6.9 Medium
- rclonerclone before v1.75.0 Credential Exposure via S3 Redirect6.0 Medium
- ibm langflow oss, langflow +1 moreLangflow is affected by weaknesses in secret handling and sensitive configuration access6.5 Medium
- apache answerApache Answer: Unauthorized disclosure of deleted or pending answer content7.5 High
- statamic cmsStatamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable6.2 Medium
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes...7.5 High
- unknown mlsimport: idx plugin & mls plugin for real estate listingsMLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item4.3 Medium
- unknown dhl shipping germany for woocommerceDHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory3.7 Low
- paolo geodirectoryGeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users6.5 Medium
- unknown passsterContent Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disclosure via Content-Lock Block data-content Attribute7.5 High
- unknown passsterContent Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API7.5 High
- unknown passsterContent Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint7.5 High
- tryghost ghostGhost: Blind Password Hash Disclosure in Ghost Admin API4.8 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints6.5 Medium
- flowiseai flowiseFlowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service9.2 Critical
- flowiseai flowiseFlowise before 3.1.3 Credential Exposure via API7.1 High
- flowiseai flowiseFlowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history8.3 High
- mozilla firefoxInformation disclosure in Firefox for Android and Firefox Focus for Android6.5 Medium
- gitpython-developers gitpythonGitPython before 3.1.57 Arbitrary File Read via Repo.archive()7.1 High
- gitpython-developers gitpythonGitPython before 3.1.57 Arbitrary File Overwrite and Read7.2 High
- postcssPostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset6.3 Medium
- getgrav gravGrav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint8.6 High
- No product listedAn issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where...7.5 High
- arcadedata arcadedbArcadeDB before 26.7.3 Information Disclosure via get_server_settings7.7 High
- unknown gallery for google photosGallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure7.5 High
- arcadedata arcadedbArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server8.7 High
- pixelyoursite – your smart pixel (tag) & api manager, pro – your smart pixel (tag) manager +1 morePixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation5.3 Medium
- jegtheme jeg kit for elementor – powerful addons for elementor, widgets & templates for wordpressJeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script4.3 Medium
- mapster wp maps, unknown mapster wp maps +1 moreMapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure7.5 High
- elyin gemini-bridgegemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode6.2 Medium
- contaoContao crawler leaks auth credentials to external hosts2.6 Low
- pterodactyl wingsWings exposes node configuration secrets through egg configuration-file templating9.9 Critical
- unknown geeky botGeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History7.5 High
- joomsky js help deskJS Help Desk < 3.1.4 - Contributor+ User Email Disclosure6.5 Medium
- joomsky js help deskJS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject6.5 Medium
- stellarwp givewpGiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure7.5 High
- opf openprojectOpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)4.3 Medium
- ibm devops deploy, ucd - ibm devops deploy, ucd - ibm urbancode deploy +1 more +3 moreIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Exposure of Sensitive Information Vulnerability4.3 Medium
- activepiecesActivepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache9.3 Critical
- tigera calico, calico cloud, calico enterprise +2 moreUnauthenticated Go pprof exposure in Calico debug server6.0 Medium
- unknown lifterlmsLifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_posts4.3 Medium
- jetmonsters motopress hotel bookingHotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action4.3 Medium
- Show moreLoading…