CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- kingaddons.com king addons for elementorKing Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode2.7 Low
- google chromeInformation leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to...6.5 Medium
- google chromeInformation leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker...4.3 Medium
- edwardkim rhwprhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages4.7 Medium
- punchin-app punchin-emailpunchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To2.1 Low
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System drug_recommendor.sql information disclosure6.9 Medium
- asynchttpclient async-http-clientAsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target6.8 Medium
- umbraco umbraco-cmsUmbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion8.7 High
- kiteworks security-advisoriesSteeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets5.9 Medium
- vendurehq vendureVendure: Shop API list queries can return non-public entities when filterOperator is OR5.3 Medium
- dell openmanage server administrator, openmanage server administrator managed node (patch) for windows, openmanage server administrator managed node for rhel 8.10 +3 more +5 moreDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of...7.3 High
- patriksimek vm2vm2 before 3.11.7 Memory Disclosure via Buffer Pool10.0 Critical
- patriksimek vm2vm2 before 3.11.8 Information Disclosure via util.getCallSites6.9 Medium
- getgrav gravGrav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r8.7 High
- getgrav gravGrav through 2.0.21 Unauthenticated Information Disclosure via Clockwork8.7 High
- suse observabilityService token exposure and potential privilege escalation in SUSE Observability5.7 Medium
- unknown comments import & exportComments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export2.7 Low
- thimpress learnpressLearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint3.7 Low
- djust-org djustdjust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client6.5 Medium
- craftcms cmsCraft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL8.7 High
- modelcontextprotocol rust-sdkRMCP: Custom HTTP headers leak to cross-origin redirect targets6.8 Medium
- browserlessbrowserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass7.1 High
- goharbor harborHarbor through 2.15.2 Scanner Credential Disclosure via Query Parameter7.1 High
- cisco nexus dashboardCisco Nexus Dashboard Software Security Hardening Release September 2026 - Information Exposure & Insecure Handling8.8 High
- open-telemetry opentelemetry-goOpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs2.0 Low
- tanium discoverTanium addressed an information disclosure vulnerability in Discover.6.5 Medium
- zopefoundation restrictedpythonRestrictedPython: Sandbox escape via string.Formatter field resolution8.4 High
- a2ui-project a2uia2ui-project a2ui Model Processor model-processor.ts information disclosure5.3 Medium
- unknown rox appointment bookingRox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes5.3 Medium
- unknown rox appointment bookingRox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route5.3 Medium
- unknown subscriptions for woocommerceSubscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass5.3 Medium
- thimpress learnpressLearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API5.3 Medium
- thimpress learnpressLearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order3.7 Low
- thimpress learnpressLearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax5.3 Medium
- thimpress learnpressLearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax5.3 Medium
- themeum tutor lmsTutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure4.3 Medium
- mahmudul hasan arif fluentboardsFluentBoards < 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDOR4.3 Medium
- magazine3 schema & structured data for wp & ampSchema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output5.3 Medium
- anzia ni woocommerce sales reportNi WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' Parameter5.3 Medium
- niaefeup tts-be`tts-be` application has a Broken Access Control vulnerability7.5 High
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...7.1 High
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...7.5 High
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...7.1 High
- oracle purchasingVulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing...7.7 High
- oracle e-business suite, oracle corporation assets +1 moreVulnerability in the Oracle Assets product of Oracle E-Business Suite (component: Internal...6.5 Medium
- oracle e-business suite, oracle corporation engineering +1 moreVulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change...7.7 High
- oracle corporation complex maintenance, repair and overhaulVulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business...8.5 High
- oracle jdeveloperVulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle...7.5 High
- oracle communications cloud native core security edge protection proxyVulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy...5.4 Medium
- oracle communications cloud native core security edge protection proxyVulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy...7.1 High
- Show moreLoading…