CWE-200 · Information Disclosure (page 11)
Page 11 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9656 | Medium | 4.3 | 2026-07-17 | The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc… |
CVE-2026-13402 | Medium | 5.3 | 2026-07-17 | The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its RES… |
CVE-2026-14503 | Medium | 6.5 | 2026-07-17 | The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pcl_ajax_proce… |
CVE-2024-32387 | Medium | 5.7 | 2026-07-16 | An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via the community string… |
CVE-2024-32385 | Medium | 4.3 | 2026-07-16 | An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via a boardID and revisio… |
CVE-2026-55406 | | 2026-07-16 | Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView<V> type allow… | |
CVE-2026-47751 | | 2026-07-16 | Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out… | |
CVE-2026-57205 | Medium | 4.3 | 2026-07-16 | SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated… |
CVE-2026-53598 | High | 7.5 | 2026-07-16 | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter wi… |
CVE-2026-56456 | Medium | 5.3 | 2026-07-16 | HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding i… |
CVE-2026-35145 | Low | 3.1 | 2026-07-16 | HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Sec… |
CVE-2026-35143 | Low | 3.0 | 2026-07-16 | HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated… |
CVE-2026-35142 | Low | 2.6 | 2026-07-16 | HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated serv… |
CVE-2026-35140 | Low | 3.0 | 2026-07-16 | HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute… |
CVE-2026-55608 | Medium | 4.2 | 2026-07-15 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with… |
CVE-2026-52888 | Medium | 6.8 | 2026-07-15 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plug… |
CVE-2026-45737 | Medium | 6.3 | 2026-07-15 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kuberne… |
CVE-2026-40956 | Low | 3.7 | 2026-07-15 | CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55. Attackers with intimate knowledge of and total control ove… |
CVE-2026-49988 | Medium | 5.5 | 2026-07-15 | Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can… |
CVE-2026-20298 | Medium | 5.3 | 2026-07-15 | In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2… |
CVE-2026-45793 | High | 7.5 | 2026-07-15 | Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth toke… |
CVE-2026-58554 | Medium | 6.6 | 2026-07-15 | Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-13230 | Medium | 6.5 | 2026-07-15 | An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocatio… |
CVE-2026-52101 | Critical | 9.1 | 2026-07-14 | An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in u… |
CVE-2026-49853 | High | 7.7 | 2026-07-14 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed onl… |
CVE-2026-48001 | Low | 3.7 | 2026-07-14 | Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on condit… |
CVE-2026-15642 | Low | 3.3 | 2026-07-14 | Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an at… |
CVE-2026-57102 | High | 8.8 | 2026-07-14 | Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-57095 | Medium | 6.2 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-56184 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-50681 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally. |
CVE-2026-50483 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information locally. |
CVE-2026-50473 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-50456 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-50442 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-50434 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally. |
CVE-2026-50431 | Medium | 5.5 | 2026-07-14 | Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability |
CVE-2026-50430 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally. |
CVE-2026-50429 | High | 8.2 | 2026-07-14 | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-50419 | Low | 3.3 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-50416 | Low | 3.3 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-50415 | Medium | 5.3 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Media allows an unauthorized attacker to disclose information over a network. |
CVE-2026-50409 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Overlay Filter allows an authorized attacker to disclose information locally. |
CVE-2026-50394 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally. |
CVE-2026-50389 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-50352 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally. |
CVE-2026-50339 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally. |
CVE-2026-50334 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Notification allows an authorized attacker to disclose information locally. |
CVE-2026-50697 | High | 7.8 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-50350 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Trusted Runtime Interface Driver allows an authorized attacker to disclose information lo… |
CVE-2026-49807 | Medium | 6.2 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally. |
CVE-2026-47282 | Medium | 6.5 | 2026-07-14 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
CVE-2026-41087 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-34349 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally. |
CVE-2026-34328 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Audio Service allows an authorized attacker to disclose information locally. |
CVE-2026-33842 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-55651 | High | 7.1 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an… |
CVE-2026-52837 | | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/… | |
CVE-2026-15075 | High | 7.5 | 2026-07-14 | In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers a… |
CVE-2026-10051 | High | 7.5 | 2026-07-14 | In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Su… |
CVE-2026-15627 | Medium | 4.3 | 2026-07-14 | A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/t… |
CVE-2026-12385 | Medium | 4.3 | 2026-07-13 | The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parame… |
CVE-2026-15530 | Medium | 5.3 | 2026-07-13 | A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=up… |
CVE-2026-56336 | Medium | 5.3 | 2026-07-12 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id a… |
CVE-2026-56259 | High | 8.2 | 2026-07-12 | Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-cont… |
CVE-2026-56238 | High | 7.5 | 2026-07-12 | Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that allows unauthenticated attackers to… |
CVE-2026-61454 | Medium | 5.3 | 2026-07-11 | The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at… |
CVE-2026-61426 | High | 8.6 | 2026-07-11 | PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated a… |
CVE-2026-56303 | High | 7.5 | 2026-07-11 | Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable b… |
CVE-2026-6801 | Medium | 5.3 | 2026-07-11 | The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_pop… |
CVE-2026-10865 | Medium | 5.3 | 2026-07-11 | The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template… |
CVE-2026-7544 | Medium | 4.3 | 2026-07-11 | The Mux Video Uploader plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the muxvideo_enqueu… |
CVE-2026-12426 | Medium | 5.3 | 2026-07-11 | The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3… |
CVE-2026-59155 | | 2026-07-10 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notificati… | |
CVE-2026-55882 | | 2026-07-10 | Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers un… | |
CVE-2026-57219 | High | 7.5 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client… |
CVE-2026-55664 | Medium | 4.3 | 2026-07-10 | Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying th… |
CVE-2026-57474 | Medium | 5.3 | 2026-07-10 | Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This infor… |
CVE-2026-59180 | Low | 3.1 | 2026-07-10 | Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, A… |
CVE-2026-55500 | Critical | 9.9 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys… |
CVE-2026-57994 | Medium | 5.3 | 2026-07-10 | phpMyFAQ before 4.1.5 applies inconsistent active=yes and publication-date filtering across its public FAQ API endpoints, allowing unauthenticated attackers to… |
CVE-2026-15329 | Medium | 4.3 | 2026-07-10 | A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue affects the function BrowserTool._do_navigate of the file agent/tools/browser/browser_to… |
CVE-2026-59828 | Medium | 5.3 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, post revisions that should be hidden from regular users c… |
CVE-2026-49256 | High | 7.5 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly r… |
CVE-2026-45788 | High | 7.5 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, secure uploads could be exposed by pull_hotlinked_images… |
CVE-2026-45780 | Medium | 5.3 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample… |
CVE-2025-63579 | High | 7.5 | 2026-07-09 | Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming dat… |
CVE-2026-59720 | High | 7.5 | 2026-07-09 | Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input f… |
CVE-2026-59222 | Medium | 6.5 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full Use… |
CVE-2026-59216 | High | 7.7 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool… |
CVE-2026-59209 | Medium | 6.5 | 2026-07-09 | n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared wor… |
CVE-2026-57481 | | 2026-07-08 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscri… | |
CVE-2026-15044 | Medium | 6.3 | 2026-07-08 | A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific security setting is not enabled, these s… |
CVE-2026-56298 | Medium | 4.3 | 2026-07-08 | Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can up… |
CVE-2026-56284 | Medium | 5.3 | 2026-07-08 | Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id)… |
CVE-2026-56226 | High | 7.5 | 2026-07-08 | Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the… |
CVE-2026-44877 | Medium | 6.5 | 2026-07-07 | An unauthenticated remote disclosure vulnerability has been identified in HPE Networking Instant On 1830, 1930, and 1960 Switches. Successful exploitation of t… |
CVE-2026-49487 | Medium | 6.5 | 2026-07-07 | In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred… |
CVE-2026-48892 | Medium | 6.5 | 2026-07-07 | The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFL… |
CVE-2026-48891 | Medium | 4.3 | 2026-07-07 | A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still e… |