CWE-209: Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- progress telerik ui for asp.net ajaxRadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.NET AJAX7.5 High
- parse-community parse-serverParse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion6.9 Medium
- mkreyman mcp-memory-keeperMCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePath6.2 Medium
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access5.3 Medium
- hcl software aftermarket epcHCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages...5.3 Medium
- apache camel, apache software foundation camel undertow +1 moreApache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal informati…5.3 Medium
- apache camelApache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal…5.3 Medium
@asymmetric-effort/specifyjsnpm@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state6.9 Medium- surrealdbSurrealDB before 3.1.0 Information Disclosure via Error Messages5.3 Medium
- mycomplianceoffice mco, mycomplianceoffice +1 morePath Disclosure and Path Traversal in MCO5.1 Medium
- cap-go capgoCapgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String6.9 Medium
- ibm watsonx.data intelligenceError Message Containing Sensitive Information found in Watson Data Intelligence4.3 Medium
- envoyproxy envoyEnvoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption6.8 Medium
- surrealdbSurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER8.3 High
- jleehr canto-saas-apicanto-saas-api: OAuth credentials exposed in URL query string and exception messages5.3 Medium
- hcl software zie, hcltech zie for web +1 moreHCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,4.3 Medium
- pipeboard-co meta-ads-mcpMeta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token9.1 Critical
- broadcom spring web services, spring web services +1 moreSOAP security faults leak Spring Security account state5.3 Medium
- spring data rest, vmware spring data rest +1 moreSpring Data REST exposes persistence-layer internals in error responses5.3 Medium
- siderolabs omniOmni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic2.7 Low
- hcl icontrolHCL iControl was affected by Weak Input Validation vulnerability. .4.3 Medium
- hcl icontrolHCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerability3.1 Low
- appsmithAppsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter5.1 Medium
- appsmithCVE-2026-72996.3 Medium
- parse-community parse-serverParse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers6.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: information disclosure via saml ecp endpoint5.3 Medium
- ibm business automation workflow containers and traditional, business automation workflow +1 moreIBM Business Automation Workflow information leak4.3 Medium
- ibm sdi, security directory integrator +1 moreSecurity vulnerability was found in IBM Security Directory Integrator5.3 Medium
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics SQL index.php information exposure5.3 Medium
- tp-link archer ax72 firmware, tp-link systems inc. archer ax72 (sg) v1.0 +1 moreInformation Disclosure via Diagnostic Interface Due to Improper Input Validation on TP-Link's Archer AX724.6 Medium
- xyproto algernonAlgernon: Single-file mode unconditionally enables debug mode7.5 High
- nextcloud flowPossible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build1.6 Low
- givanz vvvebVvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service7.1 High
- patriksimek vm2vm2: Host File Path Disclosure via Stack Trace Information Leak5.8 Medium
- free5gcfree5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udm7.7 High
- flightphp coreFlight: Sensitive information disclosure via default error handler in flightphp/core7.5 High
- givanz vvvebVvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler6.9 Medium
- hcl bigfix service management (sm), hcltech bigfix service management +1 moreHCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module5.3 Medium
- pyloadpyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI5.3 Medium
- hcl dfxanalyticsHCL DFXAnalytics is affected by an Improper Error Handling vulnerability3.1 Low
- wwbn avideoWWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server7.5 High
- spring grpc, vmware spring grpc +1 moreSpring gRPC AuthenticationException message reflected to remote client3.7 Low
- google cloud bigquerySensitive Data Disclosure in BigQuery via Materialized View Error Messages7.1 High
- monetrmonetr is vulnerable to server-side request forgery in Lunch Flow link creation and refresh8.3 High
Meridian.MappingNuGet,Meridian.MediatorNuGet +1 moreMeridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)7.5 High- hcl aionInternal Filesystem Exploration vulnerability2.9 Low
- free5gcFree5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication7.5 High
- apache tomcat, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreApache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default7.5 High
- red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2 +1 moreMirror-registry: openshift mirror registry: user enumeration via authentication error messages5.3 Medium
- dell powerscale onefsDell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0,...4.4 Medium
- Show moreLoading…