CWE-200 · Information Disclosure (page 15)
Page 15 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8028 | Low | 3.7 | 2026-05-06 | A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.se… |
CVE-2025-52613 | Medium | 4.6 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the… |
CVE-2025-31984 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow b… |
CVE-2025-31982 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk… |
CVE-2025-31976 | Medium | 4.8 | 2026-05-06 | HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal appl… |
CVE-2025-31975 | Low | 2.6 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. Exposed server banners may reveal software ve… |
CVE-2026-8026 | Low | 3.7 | 2026-05-06 | A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/accou… |
CVE-2026-43646 | High | 7.5 | 2026-05-06 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9… |
CVE-2026-36355 | High | 7.7 | 2026-05-05 | The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the wri… |
CVE-2026-4409 | Medium | 6.5 | 2026-05-05 | The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leaked secret key and usage of a weak hash… |
CVE-2026-42223 | Medium | 6.5 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all… |
CVE-2026-42220 | Medium | 6.5 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive conf… |
CVE-2026-42151 | High | 7.5 | 2026-05-04 | Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote wri… |
CVE-2026-42092 | Medium | 6.5 | 2026-05-04 | titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role… |
CVE-2026-3504 | Medium | 5.3 | 2026-05-02 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2025-14726 | Medium | 6.5 | 2026-05-02 | The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check… |
CVE-2026-33448 | Low | 3.3 | 2026-04-30 | CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.50. Attackers with control of a modifi… |
CVE-2026-7382 | Medium | 6.5 | 2026-04-30 | Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability in MeWare Software… |
CVE-2026-7381 | Critical | 9.1 | 2026-04-29 | Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation se… |
CVE-2026-7071 | Medium | 5.3 | 2026-04-27 | A security vulnerability has been detected in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/us… |
CVE-2026-7041 | Low | 3.7 | 2026-04-26 | A vulnerability was detected in 666ghj MiroFish up to 0.1.2. The impacted element is an unknown function of the file /console of the component Werkzeug Debugge… |
CVE-2026-7021 | Low | 3.5 | 2026-04-26 | A weakness has been identified in SmythOS sre up to 0.0.15. This impacts an unknown function of the file packages/sdk/src/LLM/utils.ts of the component Connect… |
CVE-2026-41492 | Critical | 9.8 | 2026-04-24 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoi… |
CVE-2026-41079 | Medium | 4.3 | 2026-04-24 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a cr… |
CVE-2026-21515 | Critical | 9.9 | 2026-04-24 | Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a network. |
CVE-2026-41323 | High | 8.1 | 2026-04-24 | Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall featur… |
CVE-2026-41278 | High | 7.5 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GET /api/v1/public-chatflows/:id endpoint returns… |
CVE-2026-41266 | High | 7.5 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive… |
CVE-2026-4106 | Medium | 5.3 | 2026-04-23 | The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and… |
CVE-2026-41182 | Medium | 5.3 | 2026-04-23 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python… |
CVE-2026-4126 | Medium | 4.3 | 2026-04-22 | The Table Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0 via the 'table_manager' shor… |
CVE-2026-6392 | Low | 2.7 | 2026-04-22 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2026-40895 | High | 7.5 | 2026-04-21 | follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HT… |
CVE-2026-34318 | Medium | 5.8 | 2026-04-21 | Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 a… |
CVE-2026-34313 | Medium | 6.5 | 2026-04-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2026-34305 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.4.0… |
CVE-2026-34300 | Medium | 6.5 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise FIN Contracts product of Oracle PeopleSoft (component: Contracts). The supported version that is affected is 9.2… |
CVE-2026-34297 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integration). Supported versions that are affecte… |
CVE-2026-34296 | Medium | 4.3 | 2026-04-21 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The suppor… |
CVE-2026-34273 | Medium | 5.3 | 2026-04-21 | Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 23.4-23.10. Easily exploitable vulnerability allows unauth… |
CVE-2026-34268 | Low | 2.9 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2026-22016 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions… |
CVE-2026-22015 | Medium | 4.3 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.0-8.0.45, 8.4… |
CVE-2026-22007 | Low | 2.9 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2026-22006 | Medium | 5.4 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Employee Snapshot). The supported version that is aff… |
CVE-2026-22001 | Low | 2.7 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.0-8.0.45, 8.4… |
CVE-2026-21999 | Medium | 5.3 | 2026-04-21 | Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.1. Difficult to exploit vulnerabi… |
CVE-2026-40908 | Medium | 5.3 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at the web root executes `git log -1` and returns the full ou… |
CVE-2026-40885 | High | 8.8 | 2026-04-21 | goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when… |
CVE-2026-41183 | Medium | 4.3 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view an… |
CVE-2026-40584 | High | 7.5 | 2026-04-21 | RansomLook is a tool to monitor Ransomware groups and markets and extract their victims. Prior to 1.9.0, the API in the affected application improperly filters… |
CVE-2026-40498 | Critical | 9.8 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that… |
CVE-2026-6782 | High | 7.5 | 2026-04-21 | Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6770 | Medium | 6.5 | 2026-04-21 | Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2026-6756 | High | 7.5 | 2026-04-21 | Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150. |
CVE-2026-31370 | Medium | 6.3 | 2026-04-21 | Honor E APP is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-34839 | Medium | 6.5 | 2026-04-21 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (`/api/4/*`) that is accessi… |
CVE-2026-22051 | Medium | 4.3 | 2026-04-20 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability. Successful expl… |
CVE-2026-40490 | Medium | 6.8 | 2026-04-18 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following i… |
CVE-2026-2262 | High | 7.5 | 2026-04-18 | The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v… |
CVE-2026-40293 | Medium | 6.5 | 2026-04-17 | OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentic… |
CVE-2025-65104 | High | 7.9 | 2026-04-17 | Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields… |
CVE-2026-6492 | Medium | 5.3 | 2026-04-17 | A vulnerability was detected in arnobt78 Hotel Booking Management System up to f8922d0e0f6ac1cc761974c7616f44c2bbc04bea. The impacted element is an unknown fun… |
CVE-2026-23777 | Medium | 4.3 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 throug… |
CVE-2025-15625 | Critical | 9.8 | 2026-04-17 | Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases. |
CVE-2026-40245 | High | 7.5 | 2026-04-16 | Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions 4.2.1 and below contain an information disclosure vul… |
CVE-2026-40173 | Critical | 9.4 | 2026-04-15 | Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debu… |
CVE-2026-39857 | Medium | 5.3 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the choices and c… |
CVE-2026-33888 | Medium | 5.3 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the getRestQuery… |
CVE-2026-34244 | Medium | 5.0 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role)… |
CVE-2026-34242 | High | 7.7 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks o… |
CVE-2026-33220 | Medium | 6.8 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform prop… |
CVE-2026-32631 | High | 7.4 | 2026-04-15 | Git for Windows is the Windows port of Git. Versions prior to 2.53.0.windows.3 do not have protections that prevent attackers from obtaining a user's NTLM hash… |
CVE-2025-12141 | Medium | 6.5 | 2026-04-15 | In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications… |
CVE-2026-25219 | Medium | 6.5 | 2026-04-15 | The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. This means that user with read permission… |
CVE-2026-25125 | Medium | 4.9 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability i… |
CVE-2026-33829 | Medium | 4.3 | 2026-04-14 | Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-32151 | Medium | 6.5 | 2026-04-14 | Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network. |
CVE-2026-32085 | Medium | 5.5 | 2026-04-14 | Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an authorized attacker to disclose information locally. |
CVE-2026-32084 | Medium | 5.5 | 2026-04-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-32081 | Medium | 5.5 | 2026-04-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-32079 | Medium | 5.5 | 2026-04-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2024-23104 | Medium | 5.4 | 2026-04-14 | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions… |
CVE-2026-34984 | Medium | 6.5 | 2026-04-14 | External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below con… |
CVE-2026-32270 | | 2026-04-13 | Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, the PaymentsController::actionPay discloses so… | |
CVE-2026-6160 | Medium | 5.3 | 2026-04-13 | A vulnerability was found in code-projects Simple ChatBox 1.0. Affected by this issue is the function SimpleChatbox_PHP of the file chatbox.sql of the componen… |
CVE-2026-3691 | Medium | 5.3 | 2026-04-11 | OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected insta… |
CVE-2026-40159 | Medium | 5.5 | 2026-04-10 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI’s MCP (Model Context Protocol) integration allows spawning background servers via stdio us… |
CVE-2026-31262 | Medium | 6.1 | 2026-04-10 | Cross Site Scripting vulnerability in Altenar Sportsbook Software Platform (SB2) v.2.0 allows a remote attacker to obtain sensitive information and execute arb… |
CVE-2026-6000 | Medium | 4.3 | 2026-04-10 | A vulnerability was found in code-projects Online Library Management System 1.0. Affected is an unknown function of the file /sql/library.sql of the component… |
CVE-2026-40151 | Medium | 5.3 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles… |
CVE-2026-39943 | Medium | 6.5 | 2026-04-09 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directus_revisions) whe… |
CVE-2026-5960 | Medium | 4.3 | 2026-04-09 | A weakness has been identified in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /db/hcpms.sql of the component S… |
CVE-2026-4660 | High | 7.5 | 2026-04-09 | HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. T… |
CVE-2025-62188 | High | 7.5 | 2026-04-09 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized actor… |
CVE-2026-5847 | Medium | 4.3 | 2026-04-09 | A vulnerability has been found in code-projects Movie Ticketing System 1.0. Impacted is an unknown function of the file /db/moviedb.sql of the component SQL Da… |
CVE-2026-39889 | High | 7.5 | 2026-04-08 | PraisonAI is a multi-agent teams system. Prior to 4.5.115, the A2U (Agent-to-User) event stream server in PraisonAI exposes all agent activity without authenti… |
CVE-2026-39412 | Medium | 5.3 | 2026-04-08 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.4, the sort_natural filter bypasses the ownPropertyOnly secu… |
CVE-2026-3594 | Medium | 5.3 | 2026-04-08 | The Riaxe Product Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4 via the '/wp-json/I… |
CVE-2026-27949 | Low | 2.0 | 2026-04-07 | Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address… |