CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.5.3 Medium
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.5.3 Medium
- unknown payments for hubtelPayments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log7.5 High
- hcabrera wp popular postsWP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters5.3 Medium
- accellion kiteworks, kiteworks secure data forms +1 moreKiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor8.6 High
- nvidia geforce, guest driver, rtx, quadro, nvs +1 more +3 moreNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer...7.8 High
- grafana enterprise, oss +1 moreAlert rules in restricted folders disclosed via the alert rules list API4.3 Medium
- unknown course booking systemCourse Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export5.3 Medium
- unknown yayreviewsYayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API5.3 Medium
- unknown image optimizerImage Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission Callbacks4.3 Medium
- shazahm1hotmailcom connections business directoryConnections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes5.3 Medium
- saad iqbal new user approveNew User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass5.3 Medium
- solacewp solace extraSolace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes5.3 Medium
- gedelumbung hospitalmanagementgedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure6.9 Medium
- watchguard fireware, fireware os +1 moreFireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B7.1 High
- hewlett packard enterprise (hpe) instant onAuthenticated Local Sensitive Information Disclosure in HPE Networking Instant On4.1 Medium
- eclipse foundation threadxImproper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC)...8.4 High
- the wikimedia foundation mediawiki - centralauth extensionCentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)7.5 High
- wikimedia foundation mediawiki - eventbus extensionPrivate change tags exposed to anonymous users via revision-tags-change events7.5 High
- devolutions serverMissing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and...6.5 Medium
- evbee dc-80Sensitive information leak through hidden menu5.1 Medium
- mozilla firefox, thunderbird +1 moreOther issue in the DevTools component9.8 Critical
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Networking component4.3 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Networking: JAR component4.3 Medium
- intelbras tip 125iIntelbras TIP 125i Básico sensitive information in source2.3 Low
- siyuan-note siyuanSiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages6.9 Medium
- eleveo quality managementEleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosure5.3 Medium
- jpadilla pyjwtPyJWT: PyJWKClient follows redirects when fetching JWKS7.4 High
- eleveo quality managementEleveo Quality Management QMBODownload information disclosure5.3 Medium
- No product listedPMWeb encryptionhelper.dll information disclosure6.9 Medium
- thinkware u3000Thinkware U3000 TCP Service GET_STATUS information disclosure6.9 Medium
- apache software foundation rollerApache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files6.5 Medium
- No product listedEyeplus p2pcam Service snapshot information disclosure6.9 Medium
- No product listedEyeplus ONVIF Device GetUsers information disclosure6.9 Medium
- soft8soft llc verge3d publishing and e-commerceVerge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_file5.3 Medium
- davidanderson updraftplus: wp backup & migration pluginUpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice5.3 Medium
- azuracastAzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile7.2 High
- patriksimek vm2vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool6.9 Medium
- froxlorFroxlor before 2.3.12 Credential Disclosure via DirProtections API7.1 High
- froxlorFroxlor before 2.3.12 DKIM Private Key Disclosure via API6.9 Medium
- froxlorFroxlor before 2.3.13 Private Key Disclosure via Certificates API7.1 High
- kyvernoKyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib8.3 High
- budibase serverBudibase Server before 3.45.0 Credential Exposure via External Table Broadcast7.0 High
- budibase serverBudibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import8.6 High
- getgrav gravGrav before 2.0.25 Session Cookie Theft via Twig Sandbox8.6 High
- getgrav gravGrav before 2.0.25 Sandbox Escape via array Filter7.1 High
- siyuan-note siyuanSiYuan before v3.8.4 Clipboard Data Disclosure via IPC8.6 High
- parse-community parse-serverParse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery7.1 High
- cap-go capgo.appcapgo.app through 12.129.0 Cache Restoration of Deleted Bundles8.7 High
- unknown mcp server for wordpressMCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route2.7 Low
- Show moreLoading…