CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- mndpsingh287 file managerFile Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure5.9 Medium
- spwebguy team membersTeam Showcase Supreme < 9.3 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details5.3 Medium
- openclawOpenClaw before 2026.7.1 Authorization Bypass via diagnostics7.1 High
- openclawOpenClaw before 2026.7.1 Authorization Bypass via trajectory export7.1 High
- openclawOpenClaw before 2026.8.1 Unauthorized Command Job Access8.7 High
- openclawOpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback6.0 Medium
- openclawOpenClaw before 2026.8.1 Information Disclosure via Configuration Hash7.7 High
- openclawOpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint5.9 Medium
- google chromeInformation leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed a remote...5.3 Medium
- google chromeInformation leak in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a...6.5 Medium
- google chromeInformation leak in Networking in Google Chrome prior to 154.0.8037.57 allowed a remote attacker...6.5 Medium
- google chromeInformation leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker...3.1 Low
- google chromeInformation leak in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a local...4.6 Medium
- actualbudget actualActual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token7.1 High
- pawelmalak flameFlame through 2.4.0 Information Exposure via GET /api/config6.9 Medium
- horilla horilla-hrHorilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata6.5 Medium
- wikimedia foundation wikipedia android appCross-request disclosure of CentralAuth cookies in Wikipedia Android App5.3 Medium
- the wikimedia foundation mediawiki - wikilambda extensionRevision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract6.9 Medium
- phpCross-origin credential leak in HTTP stream wrapper redirects5.9 Medium
- zammadZammad: Sensitive Information Exposure in Integration Administration API6.9 Medium
- zammadZammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data7.1 High
- zammadZammad: Cross-User Taskbar Item Access Control Vulnerability5.3 Medium
- zammadZammad: Titles of knowledge base answers will be shown across all categories via the global search2.1 Low
- invoiceplaneInvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments4.9 Medium
- No product listedAn issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270,...7.5 High
- eclipse foundation jettyWhen Jetty's `HttpClient` make a request to a server through a forward proxy, the server may...8.2 High
- eclipse foundation jettyIn Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ```...8.2 High
- amir20 dozzleDozzle label filters do not restrict container event and statistics streams4.3 Medium
- mauriceboe trekTREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)5.3 Medium
- mauriceboe trekTREK MCP trip summary bypasses delegated OAuth read scopes4.3 Medium
- openobserveOpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials7.5 High
- web-infra-dev rsdoctor@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata7.5 High
- goauthentik authentikauthentik: Stored credentials are readable with view permission alone8.1 High
- suitenumerique docsLaSuite Doc: Public Documents Enumeration6.5 Medium
- brainstormforce spectra legacy – gutenberg blocksSpectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure4.3 Medium
- No product listedO2OA Cipher Connection CipherConnectionAction.java list information disclosure5.3 Medium
- pixelite events managerEvents Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter4.3 Medium
- unknown masteriyo lmsMasteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure4.3 Medium
- spon communications ip network audio device xc-9603SPON Communications IP Network Audio Device XC-9603 Configuration File Download sys_cfg.txt loadCfg information disclosure6.9 Medium
- intelliants subrion cmsIntelliants Subrion CMS actions.json assign-owner information disclosure6.9 Medium
- No product listedAn issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive...7.5 High
- No product listedAn issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive...7.5 High
- lb-link bl-cpe600euLB-Link BL-CPE600EU Configuration Backup Mifi_config.bin information disclosure6.9 Medium
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- klever-io klever-goKlever-Go: /log controls global node logging8.6 High
- joomshaper.com easy store extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.08.2 High
- verbb formieFormie: Missing authorization on sent notification resend modal exposes submission PII7.7 High
- cinnamon kotaemonCinnamon's kotaemon contains improper authorization checks in multi‑user chat handlers6.5 Medium
- opnsense core, redaxo +1 moreREDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration4.3 Medium
- gplsaver np quote request for woocommerceNP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page3.7 Low
- Show moreLoading…