CWE-200 · Information Disclosure (page 15)
Page 15 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59294 | Low | 2.1 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unauthorized attacker to disclose information with a physical atta… |
CVE-2025-59284 | Low | 3.3 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally. |
CVE-2025-59260 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Microsoft Failover Cluster Virtual Driver allows an authorized attacker to disclose information l… |
CVE-2025-59214 | Medium | 6.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-59211 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally. |
CVE-2025-59209 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally. |
CVE-2025-59188 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Failover Cluster allows an authorized attacker to disclose information locally. |
CVE-2025-59186 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-59184 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows High Availability Services allows an authorized attacker to disclose information locally. |
CVE-2025-58739 | Medium | 6.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-55699 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-55683 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-55679 | Medium | 5.1 | 2025-10-14 | Improper input validation in Windows Kernel allows an unauthorized attacker to disclose information locally. |
CVE-2025-55336 | Medium | 5.5 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information loca… |
CVE-2025-59921 | Medium | 6.5 | 2025-10-14 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1… |
CVE-2025-11717 | Critical | 9.1 | 2025-10-14 | When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one bein… |
CVE-2025-11710 | Critical | 9.8 | 2025-10-14 | A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised proce… |
CVE-2025-61688 | High | 8.6 | 2025-10-13 | Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API. |
CVE-2025-8915 | | 2025-10-13 | Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-in-the-middle attack via the network | |
CVE-2025-11647 | Low | 3.1 | 2025-10-12 | A flaw has been found in Tomofun Furbo 360 and Furbo Mini. This issue affects some unknown processing of the component GATT Service. This manipulation of the a… |
CVE-2025-11645 | Low | 2.4 | 2025-10-12 | A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication T… |
CVE-2025-11644 | Low | 2.0 | 2025-10-12 | A weakness has been identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is some unknown functionality of the component UART Interface. Execu… |
CVE-2025-11639 | Low | 3.3 | 2025-10-12 | A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file collect_logs.sh of the component De… |
CVE-2025-11634 | Low | 2.4 | 2025-10-12 | A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. This affects an unknown part of the component UART Interface. The manipulation results… |
CVE-2025-8484 | Medium | 5.3 | 2025-10-11 | The Code Quality Control Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in version 2.1 through publicly exposed log files. This make… |
CVE-2025-9196 | Medium | 5.3 | 2025-10-11 | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve… |
CVE-2025-58278 | Medium | 6.2 | 2025-10-11 | Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58277 | Medium | 4.0 | 2025-10-11 | Permission verification bypass vulnerability in the Camera app. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-62158 | Medium | 5.3 | 2025-10-10 | Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by t… |
CVE-2025-61780 | Medium | 5.8 | 2025-10-10 | Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability existed in `Rack::Sen… |
CVE-2025-8887 | Medium | 6.1 | 2025-10-10 | Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Infor… |
CVE-2025-8886 | Medium | 6.7 | 2025-10-10 | Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization, Incorrect Authorizati… |
CVE-2025-52634 | Low | 3.7 | 2025-10-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0. |
CVE-2025-52630 | Low | 3.7 | 2025-10-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0. |
CVE-2025-10282 | Medium | 4.7 | 2025-10-09 | BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL. |
CVE-2025-10281 | Medium | 4.7 | 2025-10-09 | BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL. |
CVE-2025-61906 | Medium | 4.3 | 2025-10-08 | Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations… |
CVE-2025-11443 | Low | 3.7 | 2025-10-08 | A weakness has been identified in JhumanJ OpnForm up to 1.9.3. This affects an unknown function of the file /api/password/email of the component Forgotten Pass… |
CVE-2025-48464 | Medium | 4.7 | 2025-10-08 | Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials… |
CVE-2025-11406 | Medium | 4.3 | 2025-10-07 | A security flaw has been discovered in kaifangqian kaifangqian-base up to 7b3faecda13848b3ced6c17c7423b76c5b47b8ab. This issue affects the function getAllUsers… |
CVE-2025-61777 | Critical | 9.4 | 2025-10-06 | Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/b… |
CVE-2025-58589 | Low | 2.7 | 2025-10-06 | When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal inform… |
CVE-2025-58581 | Medium | 4.3 | 2025-10-06 | When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal infor… |
CVE-2025-61679 | High | 7.7 | 2025-10-03 | Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low pri… |
CVE-2025-60449 | Medium | 4.9 | 2025-10-03 | An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component located in the /btcoan/ di… |
CVE-2025-9209 | Critical | 9.8 | 2025-10-03 | The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plug… |
CVE-2025-61589 | Medium | 5.9 | 2025-10-03 | Cursor is a code editor built for programming with AI. In versions 1.6 and below, Mermaid (a to render diagrams) allows embedding images which then get rendere… |
CVE-2025-61665 | High | 7.5 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identifie… |
CVE-2025-59405 | High | 7.5 | 2025-10-02 | The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo… |
CVE-2025-56161 | High | 7.5 | 2025-10-02 | YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User m… |
CVE-2025-54468 | Medium | 4.7 | 2025-10-02 | A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.c… |
CVE-2025-54290 | Medium | 5.3 | 2025-10-02 | Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without auth… |
CVE-2025-40646 | Medium | 5.4 | 2025-10-02 | Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP req… |
CVE-2025-40645 | | 2025-10-02 | Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensitive information about customers by sendi… | |
CVE-2025-10744 | Medium | 5.9 | 2025-10-01 | The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-34220 | Medium | 5.3 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contains… |
CVE-2025-8868 | Critical | 9.8 | 2025-09-29 | In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functio… |
CVE-2025-11079 | Medium | 5.3 | 2025-09-27 | A security flaw has been discovered in Campcodes Farm Management System 1.0. Affected by this issue is some unknown functionality. The manipulation results in… |
CVE-2025-45994 | High | 7.5 | 2025-09-26 | An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdir… |
CVE-2025-56463 | Medium | 6.8 | 2025-09-26 | Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure. |
CVE-2025-11028 | Medium | 5.3 | 2025-09-26 | A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. This affects an unknown part of the component Image Handler. Performing manipulation results… |
CVE-2025-11026 | Low | 3.5 | 2025-09-26 | A vulnerability was determined in givanz Vvveb up to 1.0.7.2. Affected by this vulnerability is an unknown functionality of the component Configuration File Ha… |
CVE-2025-10952 | Medium | 5.3 | 2025-09-25 | A security flaw has been discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this issue is the function stream_handler o… |
CVE-2025-36601 | Medium | 4.0 | 2025-09-25 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.11.0.0, contains an exposure of sensitive information to an unauthorized actor vulnerability. An unauthentica… |
CVE-2025-59833 | High | 7.5 | 2025-09-24 | Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plai… |
CVE-2025-59535 | Medium | 6.5 | 2025-09-22 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be… |
CVE-2025-59434 | Critical | 9.6 | 2025-09-22 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerabil… |
CVE-2025-57441 | Critical | 9.8 | 2025-09-22 | The Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information via an unauthenticated Telnet service on port 9990. Upon connect… |
CVE-2025-57437 | Critical | 9.8 | 2025-09-22 | The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977. When connected, the serv… |
CVE-2025-57433 | Medium | 6.5 | 2025-09-22 | The 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability. By sending a crafted POST request to a specific endpoint (/cwi/… |
CVE-2025-57430 | High | 7.5 | 2025-09-22 | Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get. When accessed, this endpoint returns internal conf… |
CVE-2025-59427 | | 2025-09-19 | The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default c… | |
CVE-2023-49367 | High | 8.8 | 2025-09-18 | An issue in user interface in Kyocera Command Center RX EXOSYS M5521cdn allows remote to obtain sensitive information via inspecting sent packages by user. |
CVE-2024-25011 | Medium | 5.3 | 2025-09-18 | Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the i… |
CVE-2025-10607 | Medium | 4.3 | 2025-09-17 | A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Avaliacao/diarioApi. Such man… |
CVE-2025-34185 | High | 7.5 | 2025-09-16 | Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a pre-authentication file disclosure vulnerability via the 'db_log' POST parameter. Remote attackers can… |
CVE-2025-10536 | Medium | 6.2 | 2025-09-16 | Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140… |
CVE-2025-10535 | High | 7.5 | 2025-09-16 | Information disclosure, mitigation bypass in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 143. |
CVE-2025-26711 | Medium | 5.7 | 2025-09-16 | There is an unauthorized access vulnerability in ZTE T5400. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain… |
CVE-2025-26710 | Low | 3.5 | 2025-09-16 | There is an an information disclosure vulnerability in ZTE T5400. Due to improper configuration of the access control mechanism, attackers can obtain informati… |
CVE-2025-9808 | Medium | 5.3 | 2025-09-16 | The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This mak… |
CVE-2025-43367 | Medium | 5.5 | 2025-09-15 | A privacy issue was addressed by moving sensitive data. This issue is fixed in macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protected user d… |
CVE-2025-43362 | Critical | 9.8 | 2025-09-15 | The issue was addressed with improved checks. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26. An app may be able to monitor keystrokes w… |
CVE-2025-43356 | Medium | 6.5 | 2025-09-15 | The issue was addressed with improved handling of caches. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvO… |
CVE-2025-10321 | Medium | 5.3 | 2025-09-12 | A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is an unknown function of the file /live_online.shtml. Executing manipulation can lead to informat… |
CVE-2025-56467 | Medium | 6.5 | 2025-09-12 | An issue was discovered in AXIS BANK LIMITED Axis Mobile App 9.9 that allows attackers to obtain sensitive information without a UPI PIN, such as account infor… |
CVE-2025-54376 | High | 7.5 | 2025-09-10 | Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same… |
CVE-2025-55976 | High | 8.4 | 2025-09-10 | Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local network can directly ob… |
CVE-2025-56406 | High | 7.5 | 2025-09-10 | An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supp… |
CVE-2025-10222 | Low | 3.3 | 2025-09-10 | Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the diagnostic dump component in AxxonSoft Axxon One VMS (C-Werk) 2.0.0 through 2.0.1 o… |
CVE-2025-36759 | | 2025-09-10 | Through the provision of user names, SolaX Cloud will suggest (similar) user accounts and thereby leak sensitive information such as user email addresses and p… | |
CVE-2025-55052 | Medium | 4.3 | 2025-09-09 | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2025-29089 | High | 7.5 | 2025-09-09 | An issue in TP-Link AX10 Ax1500 v.1.3.10 Build (20230130) allows a remote attacker to obtain sensitive information |
CVE-2025-55243 | High | 7.5 | 2025-09-09 | Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-53804 | Medium | 5.5 | 2025-09-09 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-47997 | Medium | 6.5 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information… |
CVE-2025-33045 | High | 8.2 | 2025-09-09 | APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unautho… |
CVE-2025-59019 | Medium | 4.3 | 2025-09-09 | Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclo… |
CVE-2025-59018 | Medium | 6.5 | 2025-09-09 | Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 all… |
CVE-2025-40803 | Low | 3.1 | 2025-09-09 | A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device exposes certain non-critical information from the… |