CWE-200 · Information Disclosure (page 13)
Page 13 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8305 | Medium | 6.5 | 2025-12-22 | An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being printed in pla… |
CVE-2025-8304 | Medium | 6.5 | 2025-12-22 | An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being accessible in… |
CVE-2025-12492 | Medium | 5.3 | 2025-12-20 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Sensit… |
CVE-2025-14591 | High | 7.5 | 2025-12-20 | In Delphix Continuous Compliance version 2025.3.0 and later, following a recent bug fix to correctly handle CR+LF (Windows and DOS) End-of-Record (EOR) charact… |
CVE-2025-68279 | High | 7.7 | 2025-12-18 | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbol… |
CVE-2025-68429 | High | 7.3 | 2025-12-17 | Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to… |
CVE-2025-68110 | Critical | 9.9 | 2025-12-17 | ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, use… |
CVE-2025-46283 | Medium | 5.5 | 2025-12-17 | A logic issue was addressed with improved validation. This issue is fixed in macOS Sonoma 14.8.4, macOS Tahoe 26.2. An app may be able to access sensitive user… |
CVE-2025-46279 | Low | 3.3 | 2025-12-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2… |
CVE-2025-46278 | Medium | 5.5 | 2025-12-17 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected user data. |
CVE-2025-43514 | Medium | 5.5 | 2025-12-17 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected user data. |
CVE-2025-14553 | | 2025-12-16 | Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force… | |
CVE-2025-46294 | Medium | 5.3 | 2025-12-16 | To enhance security, the FileMaker Server 22.0.4 installer now includes an option to disable IIS short filename enumeration by setting NtfsDisable8dot3NameCrea… |
CVE-2025-13439 | Medium | 5.9 | 2025-12-16 | The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. T… |
CVE-2025-66963 | Medium | 5.5 | 2025-12-15 | An issue in Hitron HI3120 v.7.2.4.5.2b1 allows a local attacker to obtain sensitive information via the Logout option in the index.html |
CVE-2025-11670 | Medium | 6.4 | 2025-12-15 | Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. This vulnerability is exploitable only by technicians who have… |
CVE-2025-12512 | Medium | 4.3 | 2025-12-13 | The GenerateBlocks plugin for WordPress is vulnerable to information exposure due to missing object-level authorization checks in versions up to, and including… |
CVE-2025-11693 | Critical | 9.8 | 2025-12-13 | The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.4 throug… |
CVE-2025-43542 | High | 7.5 | 2025-12-12 | This issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, m… |
CVE-2025-43538 | Medium | 5.5 | 2025-12-12 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sonoma 14.8.3… |
CVE-2025-43530 | Medium | 5.5 | 2025-12-12 | This issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2… |
CVE-2025-43523 | Medium | 5.5 | 2025-12-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26.2. An app may be able to access sen… |
CVE-2025-43509 | Medium | 5.5 | 2025-12-12 | This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able… |
CVE-2025-43473 | Medium | 5.5 | 2025-12-12 | This issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2025-43437 | Low | 3.3 | 2025-12-12 | An information disclosure issue was addressed with improved privacy controls. This issue is fixed in iOS 26.1 and iPadOS 26.1. An app may be able to fingerprin… |
CVE-2025-12408 | Medium | 5.3 | 2025-12-12 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 7… |
CVE-2025-13660 | Medium | 5.3 | 2025-12-12 | The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3. This is due to the plugin exposing a pub… |
CVE-2025-14528 | Medium | 5.3 | 2025-12-11 | A vulnerability was detected in D-Link DIR-803 up to 1.04. Impacted is an unknown function of the file /getcfg.php of the component Configuration Handler. The… |
CVE-2025-67718 | | 2025-12-11 | Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling… | |
CVE-2025-65820 | Critical | 9.8 | 2025-12-10 | An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden pa… |
CVE-2025-63094 | High | 7.5 | 2025-12-10 | XiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and indirect branch prediction, allowing attackers to access sensitiv… |
CVE-2025-52493 | Medium | 6.5 | 2025-12-10 | PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. Although these secrets appear masked as pass… |
CVE-2025-67499 | Medium | 6.6 | 2025-12-10 | The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently… |
CVE-2025-66625 | Medium | 4.9 | 2025-12-09 | Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an a… |
CVE-2025-64670 | Medium | 6.5 | 2025-12-09 | Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information over a network. |
CVE-2025-40941 | Medium | 4.3 | 2025-12-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected devices exposes server information in its responses. This could a… |
CVE-2025-40940 | Medium | 4.9 | 2025-12-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application exhibits inconsistent SNMP behavior, such as unexpecte… |
CVE-2025-14286 | Medium | 5.3 | 2025-12-09 | A vulnerability was determined in Tenda AC9 15.03.05.14_multi. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/DownloadCfg.jpg… |
CVE-2025-12558 | Medium | 4.3 | 2025-12-09 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 vi… |
CVE-2024-38798 | | 2025-12-09 | EDK2 contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful expl… | |
CVE-2025-66330 | Medium | 4.9 | 2025-12-08 | App lock verification bypass vulnerability in the file management app. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58279 | Medium | 4.4 | 2025-12-08 | Permission control vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-14198 | Medium | 5.3 | 2025-12-07 | A vulnerability was detected in Verysync 微力同步 2.21.3. This affects an unknown function of the file /safebrowsing/clientreport/download?key=dummytoken of the co… |
CVE-2025-14197 | Medium | 5.3 | 2025-12-07 | A security vulnerability has been detected in Verysync 微力同步 up to 2.21.3. The impacted element is an unknown function of the file /rest/f/api/resources/f969564… |
CVE-2025-66623 | High | 7.4 | 2025-12-05 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some… |
CVE-2025-13494 | Medium | 5.3 | 2025-12-05 | The SSP Debug plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0. This is due to the plugin stori… |
CVE-2025-13006 | Medium | 5.3 | 2025-12-05 | The SurveyFunnel – Survey Plugin for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5… |
CVE-2025-10285 | | 2025-12-04 | The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to c… | |
CVE-2025-56427 | High | 7.5 | 2025-12-04 | Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_dir function. |
CVE-2025-54304 | Critical | 9.8 | 2025-12-04 | An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. When they are powered on, an X11 display server is started. The display ser… |
CVE-2025-11379 | Medium | 5.3 | 2025-12-04 | The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and including, 0.25.9. This is due to the p… |
CVE-2025-20383 | Medium | 4.3 | 2025-12-03 | In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platfor… |
CVE-2025-12585 | Medium | 5.3 | 2025-12-03 | The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 via uplo… |
CVE-2025-41066 | Medium | 5.3 | 2025-12-02 | Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system… |
CVE-2025-41015 | High | 7.5 | 2025-12-02 | User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on t… |
CVE-2025-41014 | High | 7.5 | 2025-12-02 | User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on t… |
CVE-2025-13696 | Medium | 5.3 | 2025-12-02 | The Zigaform plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.6.5. This is due to the plugin exposing a… |
CVE-2025-66304 | Medium | 6.2 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the passwo… |
CVE-2025-13653 | Medium | 4.3 | 2025-12-01 | In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use speci… |
CVE-2025-2879 | Medium | 5.1 | 2025-12-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driv… |
CVE-2025-13804 | Medium | 4.3 | 2025-12-01 | A security flaw has been discovered in nutzam NutzBoot up to 2.6.0-SNAPSHOT. The impacted element is an unknown function of the file nutzboot-demo/nutzboot-dem… |
CVE-2025-13785 | Medium | 4.3 | 2025-11-30 | A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects some unknown processing of the file /user… |
CVE-2025-66291 | Medium | 4.3 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the interview attachment retrieval endpoint in the Recruitment mo… |
CVE-2025-66290 | Medium | 4.3 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application’s recruitment attachment retrieval endpoint does… |
CVE-2025-66027 | Medium | 6.5 | 2025-11-29 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, includ… |
CVE-2025-13683 | Medium | 6.5 | 2025-11-28 | Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8… |
CVE-2025-64312 | Medium | 4.9 | 2025-11-28 | Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58305 | Medium | 6.2 | 2025-11-28 | Identity authentication bypass vulnerability in the Gallery app. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-64311 | Medium | 5.1 | 2025-11-28 | Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-12559 | Medium | 4.3 | 2025-11-27 | Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to sanitize team email addresses to be visible only to Tea… |
CVE-2025-13765 | Medium | 4.3 | 2025-11-27 | Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, bef… |
CVE-2025-13758 | Low | 3.5 | 2025-11-27 | Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8. |
CVE-2025-59454 | Medium | 4.3 | 2025-11-27 | In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHis… |
CVE-2025-12584 | Medium | 5.3 | 2025-11-27 | The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_conte… |
CVE-2025-65278 | High | 7.5 | 2025-11-26 | An issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing unauthenticated attackers to gain sensitive information includin… |
CVE-2025-65957 | | 2025-11-26 | Core Bot Is an Open Source discord bot made for maple hospital servers. Prior to commit dffe050, the API keys (SUPABASE_API_KEY, TOKEN) are loaded using enviro… | |
CVE-2025-63729 | Critical | 9.0 | 2025-11-25 | An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SSL Certific… |
CVE-2025-60739 | Critical | 9.6 | 2025-11-25 | Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a r… |
CVE-2025-12525 | Medium | 5.3 | 2025-11-25 | The Locker Content plugin for WordPress is vulnerable to Sensitive Information Exposure in version 1.0.0 via the 'lockerco_submit_post' AJAX endpoint. This mak… |
CVE-2025-65951 | High | 8.7 | 2025-11-25 | Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based timelock encryption system fails to enforc… |
CVE-2025-63958 | Critical | 9.8 | 2025-11-24 | MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without authentication. This pa… |
CVE-2025-13596 | | 2025-11-24 | A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When cer… | |
CVE-2025-13526 | High | 7.5 | 2025-11-22 | The OneClick Chat to Order plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.8 via the 'wa_order… |
CVE-2025-12039 | Medium | 5.3 | 2025-11-21 | The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.0.5 due to… |
CVE-2025-11368 | Medium | 5.3 | 2025-11-21 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. Thi… |
CVE-2025-52669 | Medium | 4.3 | 2025-11-20 | Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the con… |
CVE-2025-63212 | Medium | 6.5 | 2025-11-19 | GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, including models LX100, LX300, LX600, and LX1000, expose sensitive session identifiers (sid) in the pub… |
CVE-2025-63209 | High | 7.5 | 2025-11-19 | The ELCA Star Transmitter Remote Control firmware 1.25 for STAR150, BP1000, STAR300, STAR2000, STAR1000, STAR500, and possibly other models, contains an inform… |
CVE-2025-63205 | High | 7.5 | 2025-11-19 | An issue was discovered in bridgetech probes VB220 IP Network Probe,VB120 Embedded IP + RF Probe, VB330 High-Capacity Probe, VB440 ST 2110 Production Analytics… |
CVE-2025-12426 | Medium | 5.3 | 2025-11-19 | The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is due to the plugin e… |
CVE-2025-12770 | Medium | 5.3 | 2025-11-19 | The New User Approve plugin for WordPress is vulnerable to unauthorized data disclosure in all versions up to, and including, 3.0.9 due to insufficient API key… |
CVE-2025-64324 | High | 7.7 | 2025-11-18 | KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user w… |
CVE-2025-37160 | Medium | 5.3 | 2025-11-18 | A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sens… |
CVE-2025-54971 | Medium | 4.3 | 2025-11-18 | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, F… |
CVE-2025-12545 | Medium | 5.3 | 2025-11-18 | The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Information Exposure in… |
CVE-2025-63891 | High | 7.5 | 2025-11-14 | Information Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store System allows a remote unauthenticated attacker to disclose ful… |
CVE-2025-54345 | High | 7.5 | 2025-11-14 | An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. Sensitive Information is exposed to an Unauthorized Actor. |
CVE-2025-12149 | | 2025-11-14 | In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, when the search is triggered from a Signal… | |
CVE-2025-11794 | Medium | 4.9 | 2025-11-14 | Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password… |
CVE-2025-12785 | High | 7.5 | 2025-11-13 | Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/o… |