CWE-200 · Information Disclosure (page 14)
Page 14 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12784 | Medium | 4.9 | 2025-11-13 | Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/o… |
CVE-2025-64703 | Medium | 6.3 | 2025-11-13 | MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can get sensitive informations by Python code in tool module, although… |
CVE-2025-12681 | Medium | 5.3 | 2025-11-13 | The Comment Edit Core – Simple Comment Editing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.0… |
CVE-2025-64705 | Medium | 4.3 | 2025-11-12 | Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, users were able to access… |
CVE-2025-20379 | Low | 3.5 | 2025-11-12 | In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2… |
CVE-2025-12732 | Medium | 4.3 | 2025-11-12 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing aut… |
CVE-2025-62206 | Medium | 6.5 | 2025-11-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over… |
CVE-2025-59240 | Medium | 5.5 | 2025-11-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2025-11697 | | 2025-11-11 | A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to… | |
CVE-2017-20210 | Critical | 9.8 | 2025-11-11 | Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research. |
CVE-2025-12010 | Medium | 6.5 | 2025-11-11 | The Authors List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.6.1 via the via arbitrary metho… |
CVE-2025-11997 | Medium | 5.3 | 2025-11-11 | The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1… |
CVE-2025-12098 | Medium | 5.3 | 2025-11-08 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up… |
CVE-2025-64179 | Medium | 5.3 | 2025-11-06 | lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/… |
CVE-2025-55342 | Medium | 5.3 | 2025-11-05 | Quipux 4.0.1 through e1774ac allows enumeration of usernames, and accessing the Ecuadorean identification number for all registered users via the Administracio… |
CVE-2025-59716 | Medium | 5.3 | 2025-11-05 | ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validatio… |
CVE-2025-20377 | Medium | 4.3 | 2025-11-05 | A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an… |
CVE-2025-12468 | Medium | 5.3 | 2025-11-05 | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure… |
CVE-2025-12677 | Medium | 5.3 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the register_api_route()… |
CVE-2025-12139 | High | 7.5 | 2025-11-05 | The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress is vulnerable to sensitive information exposure in all versions… |
CVE-2025-11749 | Critical | 9.8 | 2025-11-05 | The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoi… |
CVE-2025-62721 | Medium | 6.5 | 2025-11-04 | LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, authenticated RSS feed endpoints in the FeedController class fail to im… |
CVE-2025-62720 | Medium | 6.5 | 2025-11-04 | LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire database of links from al… |
CVE-2025-60925 | Medium | 5.3 | 2025-11-04 | codeshare v1.0.0 was discovered to contain an information leakage vulnerability. |
CVE-2025-54323 | High | 7.5 | 2025-11-04 | An issue was discovered in the camera in Samsung Mobile Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, and 1580. Improper debu… |
CVE-2025-43495 | Medium | 5.4 | 2025-11-04 | The issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. An app may be able to monitor keys… |
CVE-2025-43479 | Medium | 5.5 | 2025-11-04 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may… |
CVE-2025-43460 | Medium | 4.6 | 2025-11-04 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.1 and iPadOS 26.1. An attacker with physical access to a locked device may be a… |
CVE-2025-43455 | Medium | 5.5 | 2025-11-04 | A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. A malicious… |
CVE-2025-43449 | High | 7.5 | 2025-11-04 | The issue was addressed with improved handling of caches. This issue is fixed in iOS 26.1 and iPadOS 26.1. A malicious app may be able to track users between i… |
CVE-2025-43411 | Medium | 5.5 | 2025-11-04 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be… |
CVE-2025-43391 | Medium | 5.5 | 2025-11-04 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14… |
CVE-2025-43378 | Medium | 5.5 | 2025-11-04 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to access sen… |
CVE-2025-43360 | Medium | 5.5 | 2025-11-04 | The issue was addressed with improved UI. This issue is fixed in iOS 26 and iPadOS 26. Password fields may be unintentionally revealed. |
CVE-2025-43345 | Medium | 5.5 | 2025-11-04 | A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma… |
CVE-2025-43323 | High | 8.1 | 2025-11-04 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An… |
CVE-2025-60892 | Medium | 6.8 | 2025-11-03 | An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature. The imager's 'public-key authentication' setting unintention… |
CVE-2025-12616 | Low | 3.7 | 2025-11-03 | A vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing a manipulatio… |
CVE-2025-11983 | Medium | 4.3 | 2025-11-01 | The WP Discourse plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5.9. This is due to the plugin unconditiona… |
CVE-2025-11377 | Medium | 4.3 | 2025-11-01 | The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due… |
CVE-2025-29270 | Critical | 10.0 | 2025-10-31 | Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin pan… |
CVE-2025-12521 | Medium | 5.3 | 2025-10-31 | The Analytify Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0.3 via the Analytify Tag HTML d… |
CVE-2025-34272 | Medium | 6.5 | 2025-10-30 | In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the application does not reliably fall back to an emp… |
CVE-2025-11998 | | 2025-10-30 | The following HP Card Readers B Models (X3D03B & Y7C05B) are potentially vulnerable to information disclosure, allowing prior user identity to be inherited und… | |
CVE-2025-54548 | Medium | 4.3 | 2025-10-29 | On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes) |
CVE-2025-11203 | Low | 3.5 | 2025-10-29 | LiteLLM Information health API_KEY Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affect… |
CVE-2025-12148 | | 2025-10-29 | In Search Guard versions 3.1.1 and earlier, Field Masking (FM) rules are improperly enforced on fields of type IP (IP Address). While the content of these fie… | |
CVE-2025-12147 | | 2025-10-29 | In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule… | |
CVE-2023-7320 | Medium | 5.3 | 2025-10-29 | The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to improper CORS handling on… |
CVE-2025-60805 | High | 7.5 | 2025-10-28 | An issue was discovered in BESSystem BES Application Server thru 9.5.x allowing unauthorized attackers to gain sensitive information via the "pre-resource" opt… |
CVE-2025-60858 | High | 7.5 | 2025-10-28 | Reolink Video Doorbell Wi-Fi DB_566128M5MP_W stores and transmits DDNS credentials in plaintext within its configuration and update scripts, allowing attackers… |
CVE-2025-62524 | Medium | 5.3 | 2025-10-27 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header… |
CVE-2025-12363 | High | 7.5 | 2025-10-27 | Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-27225 | High | 7.5 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint disclo… |
CVE-2025-12297 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in infor… |
CVE-2025-61482 | High | 7.2 | 2025-10-27 | Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root access to bypass two… |
CVE-2025-52268 | High | 7.5 | 2025-10-27 | StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens. |
CVE-2025-61481 | Critical | 10.0 | 2025-10-27 | An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to… |
CVE-2025-12276 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Affected by this issue is some unknown functionality of the componen… |
CVE-2025-11760 | Medium | 5.3 | 2025-10-25 | The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all vers… |
CVE-2025-11145 | High | 7.5 | 2025-10-24 | Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerabi… |
CVE-2025-54966 | Medium | 4.3 | 2025-10-23 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. Some endpoints on the SOCET GXP Job Status Service may return sensitive information in certain situati… |
CVE-2025-6980 | High | 7.5 | 2025-10-23 | Captive Portal can expose sensitive information |
CVE-2025-62400 | Medium | 4.3 | 2025-10-23 | Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or res… |
CVE-2025-62604 | High | 7.5 | 2025-10-22 | MeterSphere is an open source continuous testing platform. Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allo… |
CVE-2025-61885 | Medium | 4.3 | 2025-10-21 | Vulnerability in the Oracle Life Sciences InForm product of Oracle Health Sciences Applications (component: Web Server). The supported version that is affect… |
CVE-2025-61764 | Medium | 5.3 | 2025-10-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2025-61750 | Medium | 4.3 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affected are 8.61 and 8.6… |
CVE-2025-53066 | High | 7.5 | 2025-10-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions… |
CVE-2025-53047 | Medium | 5.8 | 2025-10-21 | Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.28, 21.3-21.19 and 23.4-23.9… |
CVE-2025-53043 | High | 8.1 | 2025-10-21 | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.14… |
CVE-2025-53036 | High | 8.6 | 2025-10-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2025-50074 | Medium | 4.9 | 2025-10-21 | Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Security Management… |
CVE-2025-61220 | High | 7.5 | 2025-10-21 | The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to… |
CVE-2025-60344 | High | 8.6 | 2025-10-21 | A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used f… |
CVE-2025-11151 | High | 8.2 | 2025-10-21 | Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beyaz B… |
CVE-2025-6239 | Medium | 6.5 | 2025-10-21 | Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor. |
CVE-2025-62699 | | 2025-10-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Translate Extension allows Footprinting. Trans… | |
CVE-2025-57837 | Low | 2.9 | 2025-10-20 | Tileservice module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-57839 | Medium | 4.0 | 2025-10-20 | Photo module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-57838 | Medium | 4.0 | 2025-10-20 | Some Honor products are affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-10750 | Medium | 5.3 | 2025-10-18 | The PowerBI Embed Reports plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.2.0. This is due to mi… |
CVE-2025-62669 | | 2025-10-18 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exp… | |
CVE-2025-61907 | Medium | 6.5 | 2025-10-16 | Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could a… |
CVE-2025-53092 | Medium | 6.5 | 2025-10-16 | Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installat… |
CVE-2025-11196 | Medium | 4.3 | 2025-10-15 | The External Login plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.11.2 due to the 'exlog_test_con… |
CVE-2025-59294 | Low | 2.1 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unauthorized attacker to disclose information with a physical atta… |
CVE-2025-59284 | Low | 3.3 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally. |
CVE-2025-59260 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Microsoft Failover Cluster Virtual Driver allows an authorized attacker to disclose information l… |
CVE-2025-59214 | Medium | 6.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-59211 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally. |
CVE-2025-59209 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally. |
CVE-2025-59188 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Failover Cluster allows an authorized attacker to disclose information locally. |
CVE-2025-59186 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-59184 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows High Availability Services allows an authorized attacker to disclose information locally. |
CVE-2025-58739 | Medium | 6.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-55699 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-55683 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-55679 | Medium | 5.1 | 2025-10-14 | Improper input validation in Windows Kernel allows an unauthorized attacker to disclose information locally. |
CVE-2025-55336 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information loca… |