CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInformation leak in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who...3.1 Low
- google chromeInformation leak in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...6.5 Medium
- google chromeInformation leak in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...4.3 Medium
- google chromeInformation leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...4.3 Medium
- google chromeInformation leak in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...4.3 Medium
- academysoftwarefoundation openexrOpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure4.3 Medium
- node-modules urlliburllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage7.5 High
- rclonerclone before 1.75.0 Authentication Bypass via pprof6.9 Medium
- adenhq hiveHCL Hive is affected by multiple security vulnerabilities.3.7 Low
- gitpython-developers gitpythonGitPython before 3.1.59 Arbitrary File Read via TagReference.create7.1 High
- gitpython-developers gitpythonGitPython before 3.1.59 Arbitrary File Read via Repo.blame()7.1 High
- gitpython-developers gitpythonGitPython before 3.1.59 Local File Content Disclosure via .gitmodules8.6 High
- getgrav gravGrav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass7.1 High
- ransomlookRansomLook API Key Disclosure Through /admin/apikeys HTML Source9.4 Critical
- apache alluraApache Allura: Unauthenticated REST disclosure5.3 Medium
- zephyrproject zephyrUninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder5.3 Medium
- ransomlookUnauthenticated Disclosure of Scraping Credentials and Bypass Configuration via RansomLook API8.7 High
- ransomlookRedis Glob Pattern Injection Allows Unauthorized Enumeration of Private Ransomlook Data6.9 Medium
- wwbn avideoWWBN AVideo Unbound Token Authorization Bypass via Gallery8.7 High
- wwbn avideoAVideo feed/index.php Exposure of Channel Owner Email Address6.9 Medium
- damian góra fibosearchFiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure5.3 Medium
- combodo itopCombodo iTop: Access control bypass via OQL joins7.7 High
- cenodude crosswatchCrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)5.3 Medium
- esri portal for arcgisinformation disclosure vulnerability in Esri Portal for ArcGIS5.9 Medium
- esri portal for arcgisinformation disclosure vulnerability in Esri Portal for ArcGIS5.9 Medium
- microsoft ufoMicrosoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution8.8 High
- git-for-windows gitGit for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows7.4 High
- combodo itopCombodo iTop: Version disclosure via login page logo5.3 Medium
- combodo itopCombodo iTop: Insecured access to uploaded images via sniffed url7.5 High
- bluewave-labs checkmateCheckmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled7.5 High
- apache cloudstackApache CloudStack: Improper access control in Userdata reference APIs7.5 High
- apache cloudstackApache CloudStack: Unauthenticated OAuth provider client-secret disclosure7.5 High
- apache cloudstackApache CloudStack: LDAP provider configuration disclosure7.5 High
- apache cloudstackApache CloudStack: OAuth2 Token Cross-Request Leak7.5 High
- apache cloudstackApache CloudStack: Webhook Deliveries Incorrect Access4.3 Medium
- copydeleteposts duplicate postCopy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure2.7 Low
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint5.3 Medium
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS8.1 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS5.5 Medium
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS6.5 Medium
- axllent mailpitMailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)6.5 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace7.7 High
- wintercms winterWinter CMS before 1.2.13 Local File Inclusion via JavaScript6.9 Medium
io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringsslMavennetty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages8.1 High- muxinc next-videonext-video: Unauthenticated arbitrary file read via /api/video request handler6.9 Medium
- hcl software iemHCL IntelliOps Event Management is affected by multiple security vulnerabilities.4.8 Medium
- No product listedAn issue in code100xDevs 100xdevs CMS v.1.0 (2026-04-30) allows a remote attacker to obtain...7.5 High
- cisco talos intelligence for enterprise security cloud, splunk cisco talos intelligence for enterprise security cloud +1 moreInformation Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud5.3 Medium
- splunk soarInformation Disclosure through the REST API in Splunk SOAR6.5 Medium
- splunk, splunk enterprise +1 moreExposure of Sensitive Information to an Unauthorized Actor through the REST API in Splunk Enterprise7.5 High
- Show moreLoading…