CWE-200 · Information Disclosure (page 16)
Page 16 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39363 | High | 7.5 | 2026-04-07 | Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSoc… |
CVE-2026-5375 | Low | 2.7 | 2026-04-07 | An issue that could allow a user with access to a credential to view sensitive fields through an API response has been resolved. This is an instance of CWE-200… |
CVE-2026-35452 | Medium | 5.3 | 2026-04-06 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file with… |
CVE-2026-35449 | Medium | 5.3 | 2026-04-06 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by comm… |
CVE-2026-35442 | High | 8.1 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the co… |
CVE-2026-35413 | Medium | 5.3 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQL_INTROSPECTION=false is configured, Directus cor… |
CVE-2026-30613 | Medium | 4.6 | 2026-04-06 | An information disclosure vulnerability exists in AZIOT 1 Node Smart Switch (16amp)- WiFi/Bluetooth Enabled Software Version: 1.1.9 due to improper access cont… |
CVE-2026-5666 | Medium | 5.3 | 2026-04-06 | A vulnerability was detected in code-projects Online FIR System 1.0. Affected by this issue is some unknown functionality of the file /complaints.sql of the co… |
CVE-2026-34969 | High | 7.5 | 2026-04-06 | Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly i… |
CVE-2026-5650 | Medium | 5.3 | 2026-04-06 | A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sq… |
CVE-2026-5601 | Medium | 5.3 | 2026-04-05 | A vulnerability was found in Acrel Electrical Prepaid Cloud Platform 1.0. This issue affects some unknown processing of the file /bin.rar of the component Back… |
CVE-2026-5585 | Medium | 5.3 | 2026-04-05 | A vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/task_manager.go of the compon… |
CVE-2026-5571 | Medium | 5.3 | 2026-04-05 | A vulnerability was identified in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The impacted element is an unknown function of the file /fs of the component Co… |
CVE-2026-34947 | Medium | 5.3 | 2026-04-03 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-27481 | Medium | 5.3 | 2026-04-03 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-5413 | Low | 3.7 | 2026-04-02 | A vulnerability was identified in Newgen OmniDocs up to 12.0.00. Affected by this vulnerability is an unknown functionality of the file /omnidocs/GetWebApiConf… |
CVE-2026-35038 | Medium | 6.5 | 2026-04-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via `… |
CVE-2026-34785 | High | 7.5 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a stati… |
CVE-2026-5032 | High | 7.5 | 2026-04-02 | The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing… |
CVE-2026-34518 | Medium | 5.3 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohtt… |
CVE-2025-67805 | Medium | 5.9 | 2026-04-01 | A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, exposing sensiti… |
CVE-2026-2696 | Medium | 5.3 | 2026-04-01 | The Export All URLs WordPress plugin before 5.1 generates CSV filenames containing posts URLS (including private posts) in a predictable pattern using a random… |
CVE-2026-5291 | Medium | 6.5 | 2026-04-01 | Inappropriate implementation in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain potentially sensitive information from proce… |
CVE-2026-3774 | Medium | 4.7 | 2026-04-01 | The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form fields, annotations, or optional content groups (O… |
CVE-2025-71280 | Medium | 6.2 | 2026-04-01 | XenForo before 2.3.7 allows information disclosure via local account page caching on shared systems. On systems where multiple users share a browser or machine… |
CVE-2026-34215 | Medium | 6.5 | 2026-03-31 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.63 and 9.7.0-alpha.7, the verify… |
CVE-2026-33300 | Medium | 6.5 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-33073 | Medium | 5.3 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-32951 | Medium | 4.3 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-32620 | Medium | 4.3 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-32618 | Medium | 4.3 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-32143 | Medium | 6.5 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-4020 | High | 7.5 | 2026-03-31 | The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API en… |
CVE-2026-29872 | High | 8.2 | 2026-03-30 | A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19). Th… |
CVE-2026-34472 | High | 7.1 | 2026-03-30 | Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attackers on the local n… |
CVE-2026-5003 | Medium | 5.3 | 2026-03-28 | A vulnerability was found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. This affects the function handle_index of the file rag_syst… |
CVE-2026-4994 | Low | 3.5 | 2026-03-28 | A vulnerability was found in wandb OpenUI up to 1.0/3.5-turb. Affected is the function generic_exception_handler of the file backend/openui/server.py of the co… |
CVE-2026-1307 | Medium | 6.5 | 2026-03-28 | The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… |
CVE-2026-33981 | Medium | 6.5 | 2026-03-27 | changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include filter expressions allow use of the jq… |
CVE-2026-33886 | Medium | 6.5 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user… |
CVE-2026-33882 | Medium | 6.5 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown preview endpoint could be manipulated… |
CVE-2026-31951 | Medium | 6.8 | 2026-03-27 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc1 through 0.8.3-rc1, user-created MCP (Model Context Protocol) servers can include a… |
CVE-2025-15381 | High | 7.1 | 2026-03-27 | In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This… |
CVE-2026-4957 | Low | 2.7 | 2026-03-27 | A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle_tool_call of the file XAgent/function_handler.py of… |
CVE-2026-33761 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json.php` endpoints in the Scheduler plugin lack any authentica… |
CVE-2025-59031 | Medium | 4.3 | 2026-03-27 | Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted… |
CVE-2026-33745 | High | 7.4 | 2026-03-27 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.39.0, the cpp-httplib HTTP client forwards stored Basic Auth, Bear… |
CVE-2026-1556 | Medium | 6.5 | 2026-03-26 | Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated user… |
CVE-2025-55276 | Low | 3.1 | 2026-03-26 | HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability will give attackers a clearer map of the organization’s network layout. |
CVE-2025-55272 | Low | 3.1 | 2026-03-26 | HCL Aftermarket DPC is affected by Banner Disclosure vulnerability where attackers gain insights into the system’s software and version details which would all… |
CVE-2025-55265 | Medium | 6.5 | 2026-03-26 | HCL Aftermarket DPC is affected by File Discovery which allows attacker could exploit this issue to read sensitive files present in the system and may use it t… |
CVE-2026-4823 | Low | 2.5 | 2026-03-25 | A flaw has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this vulnerability is an unknown functionality of the component NTLM2 Handler… |
CVE-2025-14915 | Medium | 6.5 | 2026-03-25 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is affected by privilege escalation. A privileged… |
CVE-2026-28878 | Medium | 6.5 | 2026-03-25 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.7… |
CVE-2026-28877 | Medium | 5.5 | 2026-03-25 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4, macOS Sequo… |
CVE-2026-28820 | Medium | 5.3 | 2026-03-25 | This issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data. |
CVE-2026-33353 | Medium | 6.5 | 2026-03-24 | Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an authorization flaw in repo import allows any aut… |
CVE-2026-33627 | Medium | 6.5 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.61 and 9.6.0-alpha.55, an authent… |
CVE-2026-33161 | Medium | 4.3 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-priv… |
CVE-2026-33677 | Medium | 6.5 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `GET /api/v1/projects/:project/webhooks` endpoint returns webhook B… |
CVE-2026-4712 | High | 7.5 | 2026-03-24 | Information disclosure in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-4733 | Medium | 5.3 | 2026-03-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3. |
CVE-2025-60949 | Critical | 9.1 | 2026-03-23 | Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration fi… |
CVE-2026-23486 | Medium | 5.3 | 2026-03-23 | Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all user information, including usernames, rol… |
CVE-2026-27131 | Medium | 5.5 | 2026-03-23 | The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin u… |
CVE-2025-13997 | Medium | 5.3 | 2026-03-23 | The King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor plugin for WordPress is vulnerable to unauthent… |
CVE-2026-33422 | Low | 3.5 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `ip_address` of a flagged user is exposed to… |
CVE-2026-33180 | High | 7.5 | 2026-03-20 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP r… |
CVE-2026-33041 | Medium | 5.3 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/encryptPass.json.php exposes the application's password hashing algorithm to… |
CVE-2026-32938 | Critical | 9.9 | 2026-03-20 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file… |
CVE-2026-32890 | Critical | 9.6 | 2026-03-20 | Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. In versions 1.4.1 and below, a… |
CVE-2026-31869 | Medium | 4.3 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals… |
CVE-2026-30891 | Medium | 6.5 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a user could access another user's private activi… |
CVE-2026-29108 | Medium | 6.5 | 2026-03-20 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, an authenticated API endpoin… |
CVE-2026-33394 | Low | 2.7 | 2026-03-19 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the Post Edits admin report (/admin/reports/post_… |
CVE-2026-33355 | Medium | 6.5 | 2026-03-19 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `/private-posts` endpoint did not apply post-… |
CVE-2026-32099 | Medium | 4.3 | 2026-03-19 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, when a user has `hide_profile` enabled, their bio… |
CVE-2026-32002 | Medium | 5.3 | 2026-03-19 | OpenClaw versions prior to 2026.2.23 contain a sandbox bypass vulnerability in the sandboxed image tool that fails to enforce tools.fs.workspaceOnly restrictio… |
CVE-2026-23659 | High | 8.6 | 2026-03-19 | Exposure of sensitive information to an unauthorized actor in Azure Data Factory allows an unauthorized attacker to disclose information over a network. |
CVE-2026-32865 | Critical | 9.8 | 2026-03-19 | OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswo… |
CVE-2026-2571 | Medium | 4.3 | 2026-03-19 | The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in… |
CVE-2026-33163 | Medium | 6.5 | 2026-03-18 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.35 and 8.6.50, when a `Parse.Cloud… |
CVE-2026-32633 | Critical | 9.1 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw… |
CVE-2026-33004 | Medium | 4.3 | 2026-03-18 | Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential for attackers to ob… |
CVE-2026-32609 | High | 7.5 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on… |
CVE-2026-32596 | High | 7.5 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `g… |
CVE-2026-32266 | | 2026-03-18 | The Google Cloud Storage for Craft CMS plugin provides a Google Cloud Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.2.1, the `Def… | |
CVE-2026-32265 | | 2026-03-18 | The Amazon S3 for Craft CMS plugin provides an Amazon S3 integration for Craft CMS. In versions 2.0.2 through 2.2.4, unauthenticated users can view a list of b… | |
CVE-2026-1267 | Medium | 6.5 | 2026-03-17 | IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to la… |
CVE-2026-28506 | Medium | 4.3 | 2026-03-17 | Outline is a service that allows for collaborative documentation. Prior to 1.5.0, the events.list API endpoint, used for retrieving activity logs, contains a l… |
CVE-2026-4202 | Medium | 4.3 | 2026-03-17 | The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page. |
CVE-2025-52649 | Low | 1.8 | 2026-03-16 | HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attacker to infer or guess… |
CVE-2026-4218 | Low | 2.5 | 2026-03-16 | A vulnerability was detected in myAEDES App up to 1.18.4 on Android. Affected is an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the… |
CVE-2026-2476 | High | 7.6 | 2026-03-16 | Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain or… |
CVE-2026-22203 | Medium | 4.9 | 2026-03-13 | wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin op… |
CVE-2026-32237 | Medium | 4.4 | 2026-03-12 | Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain acce… |
CVE-2026-32142 | Medium | 5.3 | 2026-03-12 | Shopware is an open commerce platform. /api/_info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15. |
CVE-2026-32100 | Medium | 5.3 | 2026-03-12 | Shopware is an open commerce platform. /api/_info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12… |
CVE-2026-29066 | Medium | 6.2 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's bu… |
CVE-2026-4040 | Low | 3.3 | 2026-03-12 | A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The ma… |