CWE-200 · Information Disclosure (page 11)
Page 11 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68467 | Low | 3.4 | 2026-03-04 | Dark Reader is an accessibility browser extension that makes web pages colors dark. The dynamic dark mode feature of the extension works by analyzing the color… |
CVE-2026-28434 | Medium | 5.3 | 2026-03-04 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the applic… |
CVE-2026-3058 | Medium | 4.3 | 2026-03-04 | The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the `seraph_… |
CVE-2026-2747 | High | 7.5 | 2026-03-04 | SEPPmail Secure Email Gateway before version 15.0.1 decrypts inline PGP messages without isolating them from surrounding unencrypted content, allowing exposure… |
CVE-2026-2025 | High | 7.5 | 2026-03-04 | The Mail Mint WordPress plugin before 1.19.5 does not have authorization in one of its REST API endpoint, allowing unauthenticated users to call it and retrie… |
CVE-2026-1980 | Medium | 5.3 | 2026-03-04 | The WPBookit plugin for WordPress is vulnerable to unauthorized data disclosure due to a missing authorization check on the 'get_customer_list' route in all ve… |
CVE-2026-25146 | Critical | 9.6 | 2026-03-03 | OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are (at least) two p… |
CVE-2026-0025 | High | 8.4 | 2026-03-02 | In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. This could lead to local escalation o… |
CVE-2026-0005 | Medium | 6.2 | 2026-03-02 | In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps withou… |
CVE-2025-48642 | Medium | 5.5 | 2026-03-02 | In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure… |
CVE-2025-48635 | High | 7.7 | 2026-03-02 | In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This could lead to loc… |
CVE-2025-64427 | High | 7.1 | 2026-03-02 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prior, due to insufficient validation or re… |
CVE-2026-28559 | Medium | 5.3 | 2026-02-28 | wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the… |
CVE-2026-28415 | Medium | 4.3 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accep… |
CVE-2025-9908 | Medium | 6.7 | 2026-02-27 | A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain… |
CVE-2025-9907 | Medium | 6.7 | 2026-02-27 | A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive clien… |
CVE-2026-24498 | High | 7.5 | 2026-02-27 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in EFM-Networks, Inc. IpTIME T5008, EFM-Networks, Inc. IpTIME AX2004M, EFM-Networks, I… |
CVE-2026-28276 | High | 7.5 | 2026-02-26 | Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents… |
CVE-2026-28213 | Critical | 9.8 | 2026-02-26 | EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a targe… |
CVE-2026-27457 | Medium | 4.3 | 2026-02-26 | Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.obj… |
CVE-2026-27162 | Medium | 4.9 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `posts_nearby` was checking topic access but then returni… |
CVE-2026-2244 | | 2026-02-26 | A vulnerability in Google Cloud Vertex AI Workbench from 7/21/2025 to 01/30/2026 allows an attacker to exfiltrate valid Google Cloud access tokens of other use… | |
CVE-2026-24487 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulner… |
CVE-2026-20133 | Medium | 6.5 | 2026-02-25 | A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This… |
CVE-2026-27611 | Medium | 6.5 | 2026-02-25 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, t… |
CVE-2026-25135 | Medium | 4.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 have an information disclosure… |
CVE-2026-3131 | Medium | 6.5 | 2026-02-24 | Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only permiss… |
CVE-2026-2803 | High | 7.5 | 2026-02-24 | Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2783 | High | 7.5 | 2026-02-24 | Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thund… |
CVE-2026-23983 | Medium | 6.5 | 2026-02-24 | A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabl… |
CVE-2026-2976 | Medium | 4.3 | 2026-02-23 | A weakness has been identified in FastApiAdmin up to 2.2.0. Affected by this issue is the function download_controller of the file /backend/app/api/v1/module_c… |
CVE-2026-2975 | Medium | 5.3 | 2026-02-23 | A security flaw has been discovered in FastApiAdmin up to 2.2.0. Affected by this vulnerability is the function reset_api_docs of the file /backend/app/plugin/… |
CVE-2026-2894 | Medium | 5.3 | 2026-02-21 | A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget… |
CVE-2026-27467 | Low | 2.0 | 2026-02-21 | BigBlueButton is an open-source virtual classroom. In versions 3.0.19 and below, when first joining a session with the microphone muted, the client sends audio… |
CVE-2026-27452 | Medium | 5.3 | 2026-02-21 | ASN.1 TypeScript ESM library, including codecs for Basic Encoding Rules (BER) and Distinguished Encoding Rules (DER). In versions 11.0.5 and below, in some cas… |
CVE-2026-2861 | Medium | 5.3 | 2026-02-21 | A vulnerability was detected in Foswiki up to 2.1.10. The affected element is an unknown function of the component Changes/Viewfile/Oops. The manipulation resu… |
CVE-2026-27193 | Medium | 5.3 | 2026-02-21 | Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, all HTTP request header… |
CVE-2026-27161 | High | 7.5 | 2026-02-21 | GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/… |
CVE-2026-2832 | | 2026-02-20 | Certain Samsung MultiXpress Multifunction Printers may be vulnerable to information disclosure, potentially exposing address book entries and other device conf… | |
CVE-2026-26964 | Low | 2.7 | 2026-02-20 | Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to… |
CVE-2026-26326 | Medium | 4.3 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to version 2026.2.14, `skills.status` could disclose secrets to `operator.read` clients by returning raw resolved co… |
CVE-2025-13113 | Medium | 5.3 | 2026-02-19 | The Web Accessibility by accessiBe plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11. This is due… |
CVE-2026-20141 | Medium | 4.3 | 2026-02-18 | In Splunk Enterprise versions below 10.0.2, 10.0.3, 9.4.8, and 9.3.9, a low-privileged user who does not hold the "admin" Splunk role could access the Splunk M… |
CVE-2026-20137 | Low | 3.5 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, a… |
CVE-2026-27100 | Medium | 4.3 | 2026-02-18 | Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, all… |
CVE-2026-1582 | Low | 3.7 | 2026-02-18 | The WP All Export plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.14 via the export download end… |
CVE-2025-12074 | Medium | 5.3 | 2026-02-18 | The Context Blog theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.5 via the 'context_blog_modal_popup' due t… |
CVE-2026-23597 | Medium | 6.5 | 2026-02-17 | Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive inf… |
CVE-2025-70829 | Medium | 5.7 | 2026-02-17 | An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC connection string. |
CVE-2025-65717 | Medium | 4.3 | 2026-02-16 | An issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML page. |
CVE-2025-13821 | Medium | 5.7 | 2026-02-16 | Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated use… |
CVE-2025-13973 | Medium | 5.3 | 2026-02-14 | The StickEasy Protected Contact Form plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.0.2. The pl… |
CVE-2026-26273 | Critical | 9.8 | 2026-02-13 | Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks… |
CVE-2026-26069 | High | 7.5 | 2026-02-12 | Scraparr is a Prometheus Exporter for various components of the *arr Suite. From 3.0.0-beta to before 3.0.2, when the Readarr integration was enabled, the expo… |
CVE-2026-21722 | Medium | 5.3 | 2026-02-12 | Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read… |
CVE-2026-20682 | Medium | 5.3 | 2026-02-11 | A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker may be a… |
CVE-2026-20681 | Low | 3.3 | 2026-02-11 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Tahoe 26.3. An app may be able to access infor… |
CVE-2026-20680 | Medium | 6.5 | 2026-02-11 | The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPad… |
CVE-2026-20678 | Medium | 5.5 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An app may… |
CVE-2026-20674 | Medium | 4.6 | 2026-02-11 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.3 and iPadOS 26.3. An attacker with physical access to a locked device… |
CVE-2026-20662 | Medium | 4.6 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An attacker with physical a… |
CVE-2026-20648 | Medium | 5.5 | 2026-02-11 | A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Tahoe 26.3. A malicious app may be able to access… |
CVE-2026-20647 | Medium | 5.5 | 2026-02-11 | This issue was addressed with improved data protection. This issue is fixed in macOS Tahoe 26.3. An app may be able to access sensitive user data. |
CVE-2026-20641 | High | 7.1 | 2026-02-11 | A privacy issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS… |
CVE-2026-20623 | Medium | 5.5 | 2026-02-11 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26.3. An app may be able to access protected user data. |
CVE-2026-20619 | Medium | 5.5 | 2026-02-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be able to access sensiti… |
CVE-2026-20612 | Medium | 5.5 | 2026-02-11 | A privacy issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be able to a… |
CVE-2026-20606 | High | 7.1 | 2026-02-11 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4… |
CVE-2026-1669 | High | 7.5 | 2026-02-11 | Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacke… |
CVE-2026-26014 | Medium | 5.9 | 2026-02-11 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES… |
CVE-2024-26480 | High | 7.5 | 2026-02-11 | An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the admin parameter. |
CVE-2024-26479 | Medium | 5.3 | 2026-02-11 | An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the Command execution function. |
CVE-2024-26478 | Medium | 5.3 | 2026-02-11 | An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the /api/users endpoint. |
CVE-2024-26477 | High | 7.5 | 2026-02-11 | An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, amazon_sns, export… |
CVE-2026-2317 | Medium | 6.5 | 2026-02-11 | Inappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-2295 | Medium | 5.3 | 2026-02-11 | The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability che… |
CVE-2026-21260 | High | 7.5 | 2026-02-10 | Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-68686 | Medium | 5.9 | 2026-02-10 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 thro… |
CVE-2026-2268 | High | 7.5 | 2026-02-10 | The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.0. This is due to the unsafe ap… |
CVE-2026-24098 | Medium | 6.5 | 2026-02-09 | Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors… |
CVE-2026-2148 | Medium | 5.3 | 2026-02-08 | A security vulnerability has been detected in Tenda AC21 16.03.08.16. Affected is an unknown function of the file /cgi-bin/DownloadFlash of the component Web M… |
CVE-2026-2147 | Medium | 5.3 | 2026-02-08 | A weakness has been identified in Tenda AC21 16.03.08.16. This impacts an unknown function of the file /cgi-bin/DownloadLog of the component Web Management Int… |
CVE-2026-2207 | Medium | 5.3 | 2026-02-08 | A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/publications/activities.js of the component A… |
CVE-2026-2205 | Medium | 4.3 | 2026-02-08 | A vulnerability was identified in WeKan up to 8.20. This affects an unknown part of the file server/publications/cards.js of the component Meteor Publication H… |
CVE-2026-1727 | | 2026-02-06 | The Agentspace service was affected by a vulnerability that exposed sensitive information due to the use of predictable Google Cloud Storage bucket names. Thes… | |
CVE-2026-25650 | High | 7.5 | 2026-02-06 | MCP Salesforce Connector is a Model Context Protocol (MCP) server implementation for Salesforce integration. Prior to 0.1.10, arbitrary attribute access leads… |
CVE-2025-70963 | High | 7.6 | 2026-02-06 | Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HT… |
CVE-2026-2056 | Medium | 5.3 | 2026-02-06 | A security vulnerability has been detected in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. The impacted element is an unknown function of the file /wan_connec… |
CVE-2026-2055 | Medium | 5.3 | 2026-02-06 | A weakness has been identified in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. The affected element is an unknown function of the component DHCP Client Inform… |
CVE-2026-2054 | Medium | 5.3 | 2026-02-06 | A security flaw has been discovered in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. Impacted is an unknown function of the component Wifi Setting Handler. Per… |
CVE-2026-24916 | Medium | 5.9 | 2026-02-06 | Identity authentication bypass vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-21626 | High | 7.5 | 2026-02-06 | Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure |
CVE-2026-21532 | High | 8.2 | 2026-02-05 | Azure Function Information Disclosure Vulnerability |
CVE-2026-25523 | Medium | 5.3 | 2026-02-04 | Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowl… |
CVE-2026-25475 | Medium | 6.5 | 2026-02-04 | OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolu… |
CVE-2025-61917 | High | 7.7 | 2026-02-04 | n8n is an open source workflow automation platform. From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the… |
CVE-2026-20730 | Low | 3.3 | 2026-02-04 | A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information. Note: Softwa… |
CVE-2025-15508 | Medium | 5.3 | 2026-02-04 | The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.4 via the ge… |
CVE-2025-15482 | Medium | 5.3 | 2026-02-04 | The Chapa Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0… |
CVE-2025-52631 | Low | 3.7 | 2026-02-03 | HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connections, potentially expo… |