CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- fullworks quick event managerQuick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download5.3 Medium
- plugins360 all-in-one video galleryAll-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure5.3 Medium
- kendysond payment forms for paystackPayment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Settings Page4.9 Medium
- roziscoding jackjack: upstream error responses expose backend and peer credentials8.4 High
- basekick-labs arcArc: DuckDB I/O aliases bypass database RBAC after CVE-2026-477356.5 Medium
- ladybirdLadybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation7.1 High
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection7.5 High
- socfortress copilotSOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount9.3 Critical
- parse-community parse-serverParse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses2.3 Low
- forocoches comments editorDisplay of information in the Forocoches comments editor8.2 High
- themekraft buddyformsBuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure5.3 Medium
- unknown security plugin, firewall & malware scanner with auto removalSecurity by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer4.4 Medium
- @clerk nuxtNuxt dev server exposes private runtime config through the Nitro dev bundle5.9 Medium
- sylphxai pdf-reader-mcpPDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY7.5 High
- kubeflow pipelinesKubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant7.5 High
- parse-community parse-serverParse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields2.3 Low
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities6.5 Medium
- bmc it service management suiteSystem Account Credential Disclosure in BMC ITSM5.3 Medium
- websoudan mw wp formMW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter5.3 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})5.3 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration5.3 Medium
- paolo geodirectoryGeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure5.3 Medium
- af themes wp post authorWP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure3.7 Low
- unknown link libraryLink Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure5.3 Medium
- unknown recipe card blocks liteRecipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure5.3 Medium
- frangoteamA information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA ...5.3 Medium
- maotoumao musicfreedesktopmaotoumao MusicFreeDesktop Request Forwarder information disclosure5.3 Medium
- @graphql-tools executor-legacy-ws, ardatan graphql-tools +1 moreGraphQL Tools: Shared legacy executor routes one subscription's results to a different caller6.0 Medium
MySqlConnectorNuGetMySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)6.9 Medium- fearlessgeekmedia fearlesscmsFearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS9.4 Critical
- dalibo postgresql anonymizerPostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule5.7 Medium
- dalibo postgresql anonymizerPostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting5.7 Medium
- apache software foundation kafkaApache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint8.1 High
- paolo geodirectoryGeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode2.7 Low
- unknown essential addons for elementorEssential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler5.3 Medium
- gpriday page builder by siteoriginPage Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments2.7 Low
- payplug for woocommerce (official), unknown payplug for woocommerce (official) +1 morePayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent6.5 Medium
- unknown royal addons for elementorRoyal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content5.3 Medium
- unknown payconiqPayconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure5.3 Medium
- a2ui-project a2uia2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure5.3 Medium
- mlflowMLflow CrewAI autologging records LLM provider API keys in logged trace spans6.5 Medium
- modelcontextprotocol python-sdkModel Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies5.9 Medium
- mozilla thunderbirdBypass of remote UNC path restriction in mailbox: URLs8.1 High
- mozilla thunderbirdContent of other messages could be included when replying to a crafted message7.5 High
- nextcloud tablesThe Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of shar…3.3 Low
- getgrav gravGrav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback8.7 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Networking: DNS component8.1 High
- mozilla firefox, thunderbird +1 moreInformation disclosure due to race condition in the Networking component8.1 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Networking: HTTP component8.1 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the CSS Parsing and Computation component6.5 Medium
- Show moreLoading…