CWE-200 · Information Disclosure (page 18)
Page 18 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-26864 | High | 7.5 | 2025-05-14 | Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache Io… |
CVE-2025-26795 | High | 7.5 | 2025-05-14 | Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in Apache IoTDB JDBC driver. This i… |
CVE-2025-22895 | Medium | 5.5 | 2025-05-13 | Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated use… |
CVE-2025-20624 | Medium | 5.7 | 2025-05-13 | Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated use… |
CVE-2025-20611 | Medium | 4.7 | 2025-05-13 | Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated use… |
CVE-2025-20030 | Low | 2.6 | 2025-05-13 | Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated use… |
CVE-2025-20013 | Medium | 5.5 | 2025-05-13 | Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated use… |
CVE-2025-32703 | Medium | 5.5 | 2025-05-13 | Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally. |
CVE-2024-56526 | Medium | 4.9 | 2025-05-13 | An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error. |
CVE-2025-31256 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.5. Hot corner may unexpectedly reveal a user’s deleted notes. |
CVE-2025-31250 | Medium | 5.5 | 2025-05-12 | An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive… |
CVE-2025-31242 | Medium | 5.5 | 2025-05-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequo… |
CVE-2025-31236 | Medium | 5.5 | 2025-05-12 | An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive… |
CVE-2025-31225 | High | 7.1 | 2025-05-12 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.5 and iPadOS 18.5. Call history from deleted apps may still appear in s… |
CVE-2025-31220 | Medium | 5.5 | 2025-05-12 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6… |
CVE-2025-31218 | Medium | 6.2 | 2025-05-12 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to observe the hostnames of new network… |
CVE-2025-31207 | High | 7.7 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An app may be able to enumerate a user's installed apps. |
CVE-2025-24220 | Medium | 5.5 | 2025-05-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.9. An app may be able to read a pe… |
CVE-2025-24155 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able… |
CVE-2025-24144 | Medium | 5.5 | 2025-05-12 | An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.7, macOS Sequoia 15… |
CVE-2025-24142 | Medium | 5.5 | 2025-05-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventu… |
CVE-2025-4536 | Medium | 5.3 | 2025-05-11 | A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical. Affected by this vulnera… |
CVE-2025-4535 | Medium | 5.3 | 2025-05-11 | A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0. Affected is an unk… |
CVE-2025-4526 | Medium | 4.3 | 2025-05-11 | A vulnerability was identified in Dígitro NGC Explorer up to 3.48.21. The affected element is an unknown function of the component Configuration Page. Such man… |
CVE-2025-20221 | Medium | 5.3 | 2025-05-07 | A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and Layer 4… |
CVE-2025-3851 | Medium | 4.3 | 2025-05-07 | The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 t… |
CVE-2025-47418 | | 2025-05-06 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse. There is no visible indication w… | |
CVE-2025-47417 | | 2025-05-06 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse. When Enable Debug Images in Cr… | |
CVE-2025-46820 | High | 7.1 | 2025-05-06 | phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflo… |
CVE-2024-58252 | Medium | 6.2 | 2025-05-06 | Vulnerability of insufficient information protection in the media library module Impact: Successful exploitation of this vulnerability may affect service confi… |
CVE-2025-46813 | Medium | 5.8 | 2025-05-05 | Discourse is an open-source community platform. A data leak vulnerability affects sites deployed between commits 10df7fdee060d44accdee7679d66d778d1136510 and 8… |
CVE-2025-46720 | Low | 3.1 | 2025-05-05 | Keystone is a content management system for Node.js. Prior to version 6.5.0, `{field}.isFilterable` access control can be bypassed in `update` and `delete` mut… |
CVE-2025-4281 | Medium | 4.3 | 2025-05-05 | A vulnerability, which was classified as problematic, was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This affects an u… |
CVE-2025-4271 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-4270 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cg… |
CVE-2025-4222 | Medium | 5.9 | 2025-05-03 | The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored i… |
CVE-2025-46332 | Medium | 6.5 | 2025-05-02 | Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1… |
CVE-2025-2880 | Medium | 5.3 | 2025-05-02 | The Yame | Link In Bio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.0 through the publicly ac… |
CVE-2024-11994 | Medium | 5.7 | 2025-05-01 | APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, this could disclo… |
CVE-2023-46669 | Medium | 6.2 | 2025-05-01 | Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confidentiality and impersona… |
CVE-2025-46552 | | 2025-04-29 | KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on ver… | |
CVE-2025-24270 | Medium | 5.7 | 2025-04-29 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7… |
CVE-2025-3978 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in dazhouda lecms 3.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin/vie… |
CVE-2025-3975 | Medium | 5.3 | 2025-04-27 | A vulnerability was found in ScriptAndTools eCommerce-website-in-PHP 3.0 and classified as problematic. This issue affects some unknown processing of the file… |
CVE-2025-3966 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/hom… |
CVE-2025-32986 | High | 7.5 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint. |
CVE-2025-32983 | High | 7.5 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 allows Technical Information Disclosure via a Stack Trace. |
CVE-2025-3628 | Medium | 4.3 | 2025-04-25 | A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities. |
CVE-2025-32044 | High | 7.5 | 2025-04-25 | A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, an… |
CVE-2025-3923 | Medium | 5.3 | 2025-04-25 | The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2024-11299 | Medium | 5.3 | 2025-04-22 | The Memberpress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.37 via the WordPress core searc… |
CVE-2025-32958 | Critical | 9.8 | 2025-04-21 | Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the m… |
CVE-2025-23174 | High | 7.5 | 2025-04-21 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2025-32953 | High | 8.7 | 2025-04-18 | z80pack is a mature emulator of multiple platforms with 8080 and Z80 CPU. In version 1.38 and prior, the `makefile-ubuntu.yml` workflow file uses `actions/uplo… |
CVE-2025-28235 | High | 7.5 | 2025-04-18 | An information disclosure vulnerability in the component /socket.io/1/websocket/ of Soundcraft Ui Series Model(s) Ui12 and Ui16 Firmware v1.0.7x and v1.0.5x al… |
CVE-2025-29316 | Medium | 6.2 | 2025-04-17 | An issue in DataPatrol Screenshot watermark, printing watermark agent v.3.5.2.0 allows a physically proximate attacker to obtain sensitive information. NOTE: t… |
CVE-2025-32789 | Low | 3.1 | 2025-04-16 | EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an at… |
CVE-2025-3104 | Medium | 5.3 | 2025-04-16 | The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capabil… |
CVE-2025-30724 | High | 7.5 | 2025-04-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.6.0.0.0 and 12.2.1… |
CVE-2025-30702 | Medium | 5.3 | 2025-04-15 | Vulnerability in the Fleet Patching and amp; Provisioning component of Oracle Database Server. Supported versions that are affected are 19.3-19.26. Easily exp… |
CVE-2025-27980 | Medium | 6.5 | 2025-04-15 | cashbook v4.0.3 has an arbitrary file read vulnerability in /api/entry/flow/invoice/show?invoice=. |
CVE-2025-31494 | Low | 3.5 | 2025-04-15 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The AutoGPT Pl… |
CVE-2025-31491 | High | 8.6 | 2025-04-15 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1… |
CVE-2025-2881 | Medium | 5.3 | 2025-04-12 | The Developer Toolbar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 through the publicly acc… |
CVE-2025-2841 | Medium | 5.3 | 2025-04-12 | The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through the publicly accessib… |
CVE-2025-32080 | | 2025-04-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resour… | |
CVE-2024-52280 | High | 7.7 | 2025-04-11 | A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to acces… |
CVE-2025-23387 | Medium | 5.3 | 2025-04-11 | A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens… |
CVE-2024-52282 | Medium | 6.2 | 2025-04-11 | A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET access to the Rancher Manager Apps Cata… |
CVE-2025-32700 | | 2025-04-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program fil… | |
CVE-2025-32698 | | 2025-04-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files… | |
CVE-2025-32395 | | 2025-04-10 | Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the… | |
CVE-2025-30654 | Medium | 5.5 | 2025-04-09 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows… |
CVE-2025-30291 | Medium | 5.5 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass… |
CVE-2025-29805 | High | 7.5 | 2025-04-08 | Exposure of sensitive information to an unauthorized actor in Outlook for Android allows an unauthorized attacker to disclose information over a network. |
CVE-2025-27736 | Medium | 5.5 | 2025-04-08 | Exposure of sensitive information to an unauthorized actor in Windows Power Dependency Coordinator allows an authorized attacker to disclose information locall… |
CVE-2025-26667 | Medium | 6.5 | 2025-04-08 | Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose info… |
CVE-2025-2883 | Medium | 5.3 | 2025-04-08 | The Accept SagePay Payments Using Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0… |
CVE-2025-2882 | Medium | 5.3 | 2025-04-08 | The GreenPay(tm) by Green.Money plugin for WordPress is vulnerable to Sensitive Information Exposure in versions between 3.0.0 and 3.0.9 through the publicly a… |
CVE-2024-13820 | Medium | 5.3 | 2025-04-08 | The Melhor Envio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.15.11 via the 'run' function, whi… |
CVE-2025-3403 | Low | 2.7 | 2025-04-08 | A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is… |
CVE-2024-43046 | Medium | 5.5 | 2025-04-07 | There may be information disclosure during memory re-allocation in TZ Secure OS. |
CVE-2025-31492 | | 2025-04-06 | mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party… | |
CVE-2024-13604 | High | 7.5 | 2025-04-05 | The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all v… |
CVE-2024-42208 | Low | 3.5 | 2025-04-04 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2025-31486 | Medium | 5.3 | 2025-04-03 | Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with s… |
CVE-2025-31127 | Medium | 5.3 | 2025-04-03 | Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the ele… |
CVE-2025-31126 | Medium | 5.3 | 2025-04-03 | Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-k… |
CVE-2025-30218 | Medium | 5.9 | 2025-04-02 | Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persi… |
CVE-2025-2842 | Medium | 4.3 | 2025-04-02 | A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator… |
CVE-2025-2786 | Medium | 4.3 | 2025-04-02 | A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic… |
CVE-2003-20001 | Medium | 5.6 | 2025-04-01 | An issue was discovered on Mitel ICP VoIP 3100 devices. When a remote user attempts to log in via TELNET during the login wait time and an external call comes… |
CVE-2025-30224 | | 2025-04-01 | MyDumper is a MySQL Logical Backup Tool. The MySQL C client library (libmysqlclient) allows authenticated remote actors to read arbitrary files from client sys… | |
CVE-2025-3031 | Medium | 6.5 | 2025-04-01 | An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function. This vulnerability was fixed in Firefox 137 and Thunderbird 137. |
CVE-2024-13567 | High | 7.5 | 2025-04-01 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu… |
CVE-2025-3059 | Medium | 5.3 | 2025-03-31 | Vulnerability in Drupal Profile Private.This issue affects Profile Private: *.*. |
CVE-2025-31191 | Medium | 5.5 | 2025-03-31 | This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ven… |
CVE-2025-31183 | Critical | 9.8 | 2025-03-31 | The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 1… |
CVE-2025-30463 | Medium | 5.5 | 2025-03-31 | The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be… |
CVE-2025-30455 | Medium | 5.5 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app may be able to access private inf… |