CWE-200 · Information Disclosure (page 12)
Page 12 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-37114 | Medium | 4.3 | 2026-02-03 | GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and o… |
CVE-2025-65017 | Medium | 6.5 | 2026-02-03 | Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lea… |
CVE-2026-1371 | Medium | 5.3 | 2026-02-03 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-8590 | High | 7.5 | 2026-02-03 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Directory Indexi… |
CVE-2026-0950 | Medium | 5.3 | 2026-02-03 | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and inc… |
CVE-2025-61639 | Medium | 4.8 | 2026-02-03 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files… |
CVE-2026-25222 | High | 7.5 | 2026-02-02 | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in the sign-in process allows unauthentica… |
CVE-2025-6593 | | 2026-02-02 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php. This issue affects MediaWiki: fro… | |
CVE-2025-6590 | | 2026-02-02 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files… | |
CVE-2026-23743 | High | 7.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, permalinks pointing to access-restricted resou… |
CVE-2026-1060 | Medium | 5.3 | 2026-01-28 | The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1… |
CVE-2026-0818 | Medium | 4.3 | 2026-01-28 | When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled… |
CVE-2025-54373 | Medium | 6.5 | 2026-01-28 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a vulnerability where sen… |
CVE-2026-24473 | Medium | 5.3 | 2026-01-27 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Worke… |
CVE-2026-24870 | Low | 3.7 | 2026-01-27 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3. |
CVE-2025-67274 | High | 7.5 | 2026-01-26 | An issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive information via the excel-integration-service template download m… |
CVE-2026-1407 | Low | 2.0 | 2026-01-25 | A security flaw has been discovered in Beetel 777VR1 up to 01.00.09/01.00.09_55. This affects an unknown part of the component UART Interface. Performing a man… |
CVE-2025-6461 | Medium | 4.3 | 2026-01-25 | The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via t… |
CVE-2025-13920 | Medium | 5.3 | 2026-01-24 | The WP Directory Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the wdk_public_action… |
CVE-2026-24422 | Medium | 5.3 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to… |
CVE-2025-52026 | High | 7.5 | 2026-01-23 | An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-05-28. This unauthe… |
CVE-2026-0789 | High | 7.5 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Inclusion of Authentication Cookie in Response Body Information Disclosure Vulnerability. This vulnerability allows remote at… |
CVE-2026-21524 | High | 7.4 | 2026-01-22 | Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network. |
CVE-2026-20800 | Medium | 6.5 | 2026-01-22 | Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository… |
CVE-2025-69822 | High | 7.4 | 2026-01-22 | An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive information and escalate privileges via a crafte… |
CVE-2025-65098 | High | 7.4 | 2026-01-22 | Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any… |
CVE-2025-12738 | | 2026-01-22 | Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate ac… | |
CVE-2026-21974 | Medium | 5.3 | 2026-01-20 | Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform). The supported version that i… |
CVE-2026-21940 | High | 7.5 | 2026-01-20 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group). The supported version that is affected is 9.3.6. Easil… |
CVE-2026-21928 | Medium | 5.3 | 2026-01-20 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerabi… |
CVE-2026-0905 | Critical | 9.8 | 2026-01-20 | Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to potentially obtain pote… |
CVE-2026-1197 | Low | 3.1 | 2026-01-20 | A vulnerability was detected in MineAdmin 1.x/2.x. Affected by this vulnerability is an unknown functionality of the file /system/downloadById. Performing a ma… |
CVE-2026-1196 | Low | 3.1 | 2026-01-20 | A security vulnerability has been detected in MineAdmin 1.x/2.x. Affected is an unknown function of the file /system/getFileInfoById. Such manipulation of the… |
CVE-2026-1194 | Medium | 5.3 | 2026-01-20 | A security flaw has been discovered in MineAdmin 1.x/2.x. This affects an unknown function of the component Swagger. The manipulation results in information di… |
CVE-2026-1175 | Medium | 5.3 | 2026-01-19 | A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql of the component GraphQL Directive Han… |
CVE-2026-1170 | Medium | 5.3 | 2026-01-19 | A vulnerability was detected in birkir prime up to 0.4.0.beta.0. This issue affects some unknown processing of the file /graphql of the component GraphQL API… |
CVE-2025-12129 | Medium | 5.3 | 2026-01-17 | The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via t… |
CVE-2025-14075 | Medium | 5.3 | 2026-01-17 | The WP Hotel Booking plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.7. This is due to the plugi… |
CVE-2025-24090 | Low | 3.3 | 2026-01-16 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's insta… |
CVE-2025-24089 | Medium | 5.3 | 2026-01-16 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's insta… |
CVE-2025-68438 | High | 7.5 | 2026-01-16 | In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in… |
CVE-2025-15527 | Medium | 4.3 | 2026-01-16 | The WP Recipe Maker plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 10.2.2 via the api_get_post_summary function d… |
CVE-2026-22645 | Medium | 5.3 | 2026-01-15 | The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known sec… |
CVE-2025-67399 | Medium | 4.6 | 2026-01-14 | An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the UART port of the BK7… |
CVE-2026-22240 | High | 7.5 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated re… |
CVE-2026-22237 | Critical | 9.8 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated remote attacker could exploit this vulnera… |
CVE-2026-0717 | Medium | 5.3 | 2026-01-14 | The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 v… |
CVE-2025-14464 | Medium | 5.3 | 2026-01-14 | The PDF Resume Parser plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0. This is due to the plugin… |
CVE-2025-68966 | Medium | 5.1 | 2026-01-14 | Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-68965 | Medium | 4.7 | 2026-01-14 | Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-68959 | Medium | 6.2 | 2026-01-14 | Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidential… |
CVE-2026-20939 | Medium | 5.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-20937 | Medium | 5.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-20932 | Medium | 5.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-20862 | Medium | 5.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Windows Management Services allows an authorized attacker to disclose information locally. |
CVE-2026-20847 | Medium | 6.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to perform spoofing over a network. |
CVE-2026-20827 | Medium | 5.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to disclose inform… |
CVE-2026-20823 | Medium | 5.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-20821 | Medium | 6.2 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally. |
CVE-2026-20805 | Medium | 5.5 | 2026-01-13 | Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally. |
CVE-2025-37165 | High | 7.5 | 2026-01-13 | A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended interfaces. A mali… |
CVE-2025-47855 | Critical | 9.8 | 2026-01-13 | An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.2… |
CVE-2026-0888 | Medium | 5.3 | 2026-01-13 | Information disclosure in the XML component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. |
CVE-2026-0883 | Medium | 5.3 | 2026-01-13 | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
CVE-2025-14507 | Medium | 5.3 | 2026-01-13 | The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin… |
CVE-2026-22251 | Medium | 5.3 | 2026-01-12 | wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was dis… |
CVE-2025-65090 | Medium | 5.3 | 2026-01-10 | XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (… |
CVE-2026-22604 | Medium | 5.3 | 2026-01-10 | OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a POST request to the… |
CVE-2026-22602 | Low | 3.5 | 2026-01-10 | OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low‑privileged logged-in user can view the full names of other… |
CVE-2026-22600 | Critical | 9.1 | 2026-01-10 | OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality… |
CVE-2025-46676 | Low | 2.7 | 2026-01-09 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10… |
CVE-2025-14980 | Medium | 6.5 | 2026-01-09 | The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the scripts() function. Thi… |
CVE-2025-14574 | Medium | 5.3 | 2026-01-09 | The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.15 via the `/wp-json/wp/v2/docs/setti… |
CVE-2025-68719 | High | 8.8 | 2026-01-08 | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 mishandle configuration management. Once any user is logged in and maintains an active session, an attacker ca… |
CVE-2025-68718 | Medium | 5.4 | 2026-01-08 | KAYSUS KS-WR1200 routers with firmware 107 expose SSH and TELNET services on the LAN interface with hardcoded root credentials (root:12345678). The administrat… |
CVE-2026-0747 | Low | 3.3 | 2026-01-08 | Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows… |
CVE-2025-59469 | Critical | 9.0 | 2026-01-08 | This vulnerability allows a Backup or Tape Operator to write files as root. |
CVE-2026-21880 | Medium | 5.3 | 2026-01-08 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authenticatio… |
CVE-2026-20027 | Medium | 5.3 | 2026-01-07 | Multiple Cisco products are affected by a vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to cause the… |
CVE-2025-47369 | Medium | 5.5 | 2026-01-07 | Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID. |
CVE-2025-31964 | Low | 2.2 | 2026-01-07 | Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability… |
CVE-2025-13371 | High | 8.6 | 2026-01-07 | The MoneySpace plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.9. This is due to the plugin sto… |
CVE-2025-12540 | Medium | 4.7 | 2026-01-07 | The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.4… |
CVE-2025-13215 | Medium | 5.3 | 2026-01-06 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.17.13 via… |
CVE-2025-69226 | Medium | 5.3 | 2026-01-05 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of abso… |
CVE-2025-68436 | Medium | 6.5 | 2026-01-05 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft instal… |
CVE-2025-67732 | Medium | 6.5 | 2026-01-05 | Dify is an open-source LLM app development platform. Prior to version 1.11.0, the API key is exposed in plaintext to the frontend, allowing non-administrator u… |
CVE-2025-68273 | Medium | 5.3 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19… |
CVE-2025-61594 | High | 7.5 | 2025-12-30 | URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundl… |
CVE-2025-15103 | High | 8.1 | 2025-12-30 | DVP-12SE11T - Authentication Bypass via Partial Password Disclosure |
CVE-2025-14280 | Medium | 5.3 | 2025-12-29 | The PixelYourSite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.5 through publicly exposed lo… |
CVE-2025-15070 | Medium | 5.5 | 2025-12-29 | Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse. This issue af… |
CVE-2025-15065 | Medium | 6.3 | 2025-12-29 | Exposure of Sensitive Information to an Unauthorized Actor, Missing Encryption of Sensitive Data, Files or Directories Accessible to External Parties vulnerabi… |
CVE-2025-15141 | Low | 3.1 | 2025-12-28 | A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler… |
CVE-2025-15121 | Low | 2.4 | 2025-12-28 | A vulnerability has been found in JeecgBoot up to 3.9.0. The affected element is the function getDeptRoleByUserId of the file /sys/sysDepartRole/getDeptRoleByU… |
CVE-2024-29720 | Medium | 5.5 | 2025-12-26 | An issue in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local attacker to obtain sensitive information via the adopt component of the Sciter vide… |
CVE-2025-15082 | Medium | 5.3 | 2025-12-25 | A vulnerability was found in TOZED ZLT M30s up to 1.47. Impacted is an unknown function of the file /reqproc/proc_post of the component Web Management Interfac… |
CVE-2025-12491 | High | 7.5 | 2025-12-23 | Senstar Symphony FetchStoredLicense Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affec… |
CVE-2025-63662 | High | 7.5 | 2025-12-22 | Insecure permissions in the /api/v1/agents API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access sensitive information. |
CVE-2025-15033 | Medium | 6.5 | 2025-12-22 | A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This… |