CWE-359: Privacy violation
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
Also known as Exposure of Private Personal Information to an Unauthorized Actor, Privacy leak / Privacy leakage, PPI.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- tinyhumansai openhuman OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture 6.1 Medium
- angular Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035) 5.9 Medium
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +9 more +11 more Azure Active Directory Information Disclosure Vulnerability 6.2 Medium
- moodle Moodle: user profile information disclosure via grade web service 4.3 Medium
- invoiceplane InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments 4.9 Medium
- edwardkim rhwp rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages 4.7 Medium
- djust-org djust djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client 6.5 Medium
- lukevella rallly Rallly before 4.15.0 Information Disclosure via polls.get 6.9 Medium
- netcore nr255-v Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints 7.1 High
- apple ipados, watchos, ios and ipados +1 more +3 more A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and... 7.5 High
- apple ipados, macos, visionos +2 more +4 more A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS... 7.5 High
- apple macos A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8... 6.1 Medium
- apple ipados, ios and ipados, iphone os +2 more A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 26.6 and... 7.5 High
- wwbn avideo AVideo Incomplete API Sanitization Information Disclosure 5.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 more Windows Biometric Service Information Disclosure Vulnerability 5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 more Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability 5.5 Medium
- hclsoftware connections HCL Connections is vulnerable to an information disclosure vulnerability 3.1 Low
- cenodude crosswatch CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs) 5.3 Medium
- mozilla firefox, thunderbird +1 more Information disclosure in the Form Autofill component 7.5 High
- mozilla firefox, thunderbird +1 more Race condition, use-after-free in the Layout: Text and Fonts component 8.8 High
- qualcomm 5g fixed wireless access platform firmware, ar8035 firmware, csra6620 firmware +145 more +147 more Exposure of Private Personal Information to an Unauthorized Actor in Data Modem 6.5 Medium
- cloudreve Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicate 4.3 Medium
- gitea open source git server GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private 4.3 Medium
- microsoft remote desktop web client, windows admin center +1 more Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability 7.1 High
- microsoft defender for endpoint, defender for endpoint for mac +1 more Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability 4.7 Medium
- decolua 9router 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints 8.7 High
- decolua 9router 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats 9.3 Critical
- decolua 9router 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers 9.3 Critical
- microsoft edge chromium, edge (chromium-based) +1 more Microsoft Edge for Android Information Disclosure Vulnerability 7.1 High
- microsoft edge chromium, edge (chromium-based) +1 more Microsoft Edge for Android Information Disclosure Vulnerability 7.1 High
- hieventsdev hi.events Hi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List short_id 8.3 High
- dojin club micmnis phpuploader phpUploader < 2.0.2 Unauthenticated Database Exposure via index model 8.7 High
- dbarzin mercator Mercator has a Personal Identifiable Information Leak from Query Executor feature 7.1 High
- joomboost joomproject Joomla! Component JoomProject 1.1.3.2 Information Disclosure 8.7 High
- angular Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker 8.3 High
- apple macos A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS... 5.5 Medium
- qnap qumagie QuMagie 6.6 Medium
- apache answer Apache Answer: Authorization Bypass in Timeline API 6.1 Medium
- hellotalk HelloTalk through 3.4.1 stores full-precision GPS coordinates even when the user had intended to... 5.3 Medium
- view concept kidsview Authentication Bypass in Kidsview 5.3 Medium
- xwiki xwiki-platform XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests 7.5 High
- digital operation services wifiburada OTP Bypass in Digital Operation Services' WifiBurada 7.1 High
- thorsten phpmyfaq phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update 8.8 High
- apple ipados, macos, visionos +2 more +4 more This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and... 7.5 High
- apple ipados, ios and ipados, iphone os +2 more A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.5... 4.6 Medium
- apache cloudstack Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to 8.1 High
- apache cloudstack Apache CloudStack: Any user can create a new VM from backups they should not have access to 6.5 Medium
- lin-snow ech0 Ech0 before 4.7.3 Email Disclosure via Public API 6.9 Medium
- meware software development inc. pdks Information Disclosure in MeWare Software's PDKS 6.5 Medium
- apple ipados, ios and ipados, iphone os +2 more A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.8 and... 6.2 Medium
- Show olderLoading…