CWE-200 · Information Disclosure (page 17)
Page 17 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-46382 | Medium | 5.3 | 2025-07-20 | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2025-7874 | Medium | 5.3 | 2025-07-20 | A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2025-7394 | Critical | 9.8 | 2025-07-18 | In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to the potential for predictable values re… |
CVE-2025-50708 | High | 7.5 | 2025-07-18 | An issue in Perplexity AI GPT-4 v.2.51.0 allows a remote attacker to obtain sensitive information via the token component in the shared chat URL |
CVE-2024-42209 | Low | 3.5 | 2025-07-17 | HCL Connections is vulnerable to an information disclosure vulnerability that could allow a user to obtain sensitive information they are not entitled to, whic… |
CVE-2025-3415 | Medium | 4.3 | 2025-07-17 | Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed… |
CVE-2025-34130 | | 2025-07-16 | An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html… | |
CVE-2025-53840 | Low | 2.4 | 2025-07-16 | Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependenc… |
CVE-2025-22227 | Medium | 6.1 | 2025-07-16 | In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been exp… |
CVE-2025-30758 | Medium | 5.3 | 2025-07-15 | Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: User Interface). Supported versions that are affected are 25.0-25.5. Easily… |
CVE-2025-53887 | Medium | 5.3 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus vers… |
CVE-2025-53886 | Medium | 4.5 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flo… |
CVE-2025-53640 | Medium | 6.5 | 2025-07-14 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3… |
CVE-2024-51769 | High | 7.5 | 2025-07-14 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2025-7573 | Medium | 5.3 | 2025-07-14 | A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 202… |
CVE-2025-7572 | Medium | 5.3 | 2025-07-14 | A vulnerability classified as critical was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This vulne… |
CVE-2025-7565 | Medium | 5.3 | 2025-07-14 | A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/light… |
CVE-2020-36848 | High | 7.5 | 2025-07-12 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versi… |
CVE-2025-6745 | Medium | 5.3 | 2025-07-11 | The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via the woodmart_get_posts_by_query() funct… |
CVE-2025-4593 | Medium | 6.5 | 2025-07-11 | The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the… |
CVE-2025-34098 | | 2025-07-10 | A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper input validation in the log filtering… | |
CVE-2025-52473 | Medium | 5.9 | 2025-07-10 | liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Multiple secret-dependent branches have bee… |
CVE-2025-53624 | Critical | 10.0 | 2025-07-09 | The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions pri… |
CVE-2025-53512 | Medium | 6.5 | 2025-07-08 | The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitiv… |
CVE-2025-49671 | Medium | 6.5 | 2025-07-08 | Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose info… |
CVE-2025-49664 | Medium | 5.5 | 2025-07-08 | Exposure of sensitive information to an unauthorized actor in Windows User-Mode Driver Framework Host allows an authorized attacker to disclose information loc… |
CVE-2025-48808 | Medium | 5.5 | 2025-07-08 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-47980 | Medium | 6.2 | 2025-07-08 | Exposure of sensitive information to an unauthorized actor in Windows Imaging Component allows an unauthorized attacker to disclose information locally. |
CVE-2025-20325 | Low | 3.1 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the… |
CVE-2025-34072 | | 2025-07-02 | A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. When an AI agent usi… | |
CVE-2024-13451 | Medium | 5.3 | 2025-07-02 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2025-49741 | High | 7.4 | 2025-07-01 | No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-6600 | Medium | 4.3 | 2025-07-01 | An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an attacker to disclose the names of private rep… |
CVE-2025-34064 | | 2025-07-01 | A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without… | |
CVE-2025-34062 | | 2025-07-01 | An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with ac… | |
CVE-2025-34059 | | 2025-07-01 | An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLog… | |
CVE-2025-34051 | | 2025-07-01 | A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_q… | |
CVE-2025-53003 | | 2025-07-01 | The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verif… | |
CVE-2025-52898 | High | 8.8 | 2025-06-30 | Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting ac… |
CVE-2025-49845 | High | 7.5 | 2025-06-25 | Discourse is an open-source discussion platform. The visibility of posts typed `whisper` is controlled via the `whispers_allowed_groups` site setting. Only use… |
CVE-2025-27827 | High | 7.1 | 2025-06-24 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.2.0.3 could allow an unauthenticated attacker to conduct an informat… |
CVE-2025-6432 | High | 8.6 | 2025-06-24 | When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not respondin… |
CVE-2025-6425 | Medium | 4.3 | 2025-06-24 | An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between cont… |
CVE-2025-39204 | Medium | 6.5 | 2025-06-24 | A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. The filtering query in the Web interface can be malformed, so returning data ca… |
CVE-2023-47029 | Critical | 9.8 | 2025-06-23 | An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted POST request to the… |
CVE-2023-47298 | Medium | 4.3 | 2025-06-23 | An issue in NCR Terminal Handler 1.5.1 allows a low-level privileged authenticated attacker to query the SOAP API endpoint to obtain information about all of t… |
CVE-2025-27387 | High | 7.4 | 2025-06-23 | OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure. |
CVE-2025-52488 | High | 8.6 | 2025-06-21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM… |
CVE-2025-25037 | | 2025-06-20 | An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpo… | |
CVE-2025-52467 | Critical | 9.1 | 2025-06-19 | pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to commit 8eb3567, the pgai repository was… |
CVE-2025-23173 | High | 7.5 | 2025-06-19 | The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify… |
CVE-2025-49593 | Medium | 6.8 | 2025-06-17 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and… |
CVE-2025-49824 | | 2025-06-17 | conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.4… | |
CVE-2025-6199 | Low | 3.3 | 2025-06-17 | A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output… |
CVE-2025-49177 | Medium | 6.1 | 2025-06-17 | A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended… |
CVE-2025-49200 | Medium | 6.5 | 2025-06-12 | The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup fil… |
CVE-2025-49184 | High | 7.5 | 2025-06-12 | A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product. |
CVE-2025-49150 | Medium | 5.9 | 2025-06-11 | Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by… |
CVE-2025-4798 | Medium | 4.9 | 2025-06-11 | The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due to a lack of restri… |
CVE-2025-30675 | Medium | 4.7 | 2025-06-11 | In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue b… |
CVE-2025-26521 | High | 8.1 | 2025-06-10 | When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin' user of the calle… |
CVE-2025-43579 | Medium | 5.5 | 2025-06-10 | Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an Information Exposure vulnerability that could result in a Secur… |
CVE-2025-47969 | Medium | 4.4 | 2025-06-10 | Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized attacker to disclose information locally. |
CVE-2025-25250 | Medium | 4.3 | 2025-06-10 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, For… |
CVE-2025-49143 | Medium | 5.9 | 2025-06-10 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIA_ROOT director… |
CVE-2024-38524 | Medium | 5.3 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletReques… |
CVE-2024-34711 | Critical | 9.3 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unautho… |
CVE-2025-40662 | High | 7.5 | 2025-06-10 | Absolute path disclosure vulnerability in DM Corporative CMS. This vulnerability allows an attacker to view the contents of webroot/file, if navigating to a no… |
CVE-2025-49653 | High | 8.0 | 2025-06-09 | Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform. |
CVE-2025-25209 | Medium | 5.7 | 2025-06-09 | The AuthPolicy metadata on Red Hat Connectivity Link contains an object which stores secretes, however it assumes those secretes are already in the kuadrant-sy… |
CVE-2025-47966 | Critical | 9.8 | 2025-06-05 | Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-5690 | Medium | 6.5 | 2025-06-04 | PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data… |
CVE-2025-20129 | Medium | 4.3 | 2025-06-04 | A vulnerability in the web-based chat interface of Cisco Customer Collaboration Platform (CCP), formerly Cisco SocialMiner, could allow an unauthenticated, rem… |
CVE-2025-5436 | Medium | 5.3 | 2025-06-02 | A vulnerability was found in Multilaser Sirius RE016 MLT1.0. It has been rated as problematic. This issue affects some unknown processing of the file /cgi-bin/… |
CVE-2025-4659 | Medium | 5.3 | 2025-05-30 | The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full Path Disclosure in al… |
CVE-2025-31231 | Medium | 5.5 | 2025-05-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to read sensitive location inform… |
CVE-2025-47288 | Low | 3.5 | 2025-05-29 | Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted to a public topic… |
CVE-2025-5334 | High | 7.5 | 2025-05-29 | Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated us… |
CVE-2025-5281 | Medium | 5.4 | 2025-05-27 | Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially obtain user information via a crafted… |
CVE-2025-5064 | Medium | 5.4 | 2025-05-27 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2024-56193 | Medium | 5.1 | 2025-05-27 | There is a possible disclosure of Bluetooth adapter details due to a permissions bypass. This could lead to local information disclosure with no additional exe… |
CVE-2025-5266 | Medium | 4.3 | 2025-05-27 | Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability was fixed… |
CVE-2025-5184 | Medium | 4.3 | 2025-05-26 | A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. It has been classified as problematic. Affected is an unknown… |
CVE-2025-5098 | Critical | 9.1 | 2025-05-23 | PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account without proper authoriza… |
CVE-2024-54188 | Medium | 5.3 | 2025-05-22 | Infoblox NETMRI before 7.6.1 has a vulnerability allowing remote authenticated users to read arbitrary files with root access. |
CVE-2025-48064 | Low | 3.3 | 2025-05-21 | GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view… |
CVE-2025-4980 | Medium | 5.3 | 2025-05-20 | A vulnerability has been found in Netgear DGND3700 1.1.00.15_1.00.15NA and classified as problematic. This vulnerability affects unknown code of the file /curr… |
CVE-2024-53359 | High | 7.5 | 2025-05-20 | An issue in Zalo v23.09.01 allows attackers to obtain sensitive user information via a crafted GET request. |
CVE-2025-4977 | Medium | 5.3 | 2025-05-20 | A vulnerability, which was classified as problematic, has been found in Netgear DGND3700 1.1.00.15_1.00.15NA. Affected by this issue is some unknown functional… |
CVE-2025-41230 | High | 7.5 | 2025-05-20 | VMware Cloud Foundation contains an information disclosure vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may expl… |
CVE-2025-4904 | Medium | 5.3 | 2025-05-19 | A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. This vulnerability affects the function sub_41F0FC of th… |
CVE-2025-4902 | Medium | 5.3 | 2025-05-19 | A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected by this issue is the function sub_48F4F… |
CVE-2025-4901 | Medium | 4.3 | 2025-05-19 | A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected by this vulnerability is the function sub_41E304 of the… |
CVE-2024-13613 | High | 7.5 | 2025-05-17 | The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.3 via the 'uploads' directory. Thi… |
CVE-2025-4753 | Medium | 5.3 | 2025-05-16 | A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2025-4752 | Medium | 5.3 | 2025-05-16 | A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this vulnerability is an unknown functionali… |
CVE-2025-4751 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected is an unknown function of the file /index.da… |
CVE-2025-4750 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). This issue affects some unknown processing of th… |
CVE-2025-25370 | Medium | 4.6 | 2025-05-14 | An issue in realme GT 2 (RMX3311) running Android 14 with realme UI 5.0 allows a physically proximate attacker to obtain sensitive information via the show app… |
CVE-2024-57096 | Medium | 5.5 | 2025-05-14 | An issue in wps office before v.19302 allows a local attacker to obtain sensitive information via a crafted file. |