CWE-200 · Information Disclosure (page 20)
Page 20 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-65957 | | 2025-11-26 | Core Bot Is an Open Source discord bot made for maple hospital servers. Prior to commit dffe050, the API keys (SUPABASE_API_KEY, TOKEN) are loaded using enviro… | |
CVE-2025-63729 | Critical | 9.0 | 2025-11-25 | An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SSL Certific… |
CVE-2025-60739 | Critical | 9.6 | 2025-11-25 | Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a r… |
CVE-2025-12525 | Medium | 5.3 | 2025-11-25 | The Locker Content plugin for WordPress is vulnerable to Sensitive Information Exposure in version 1.0.0 via the 'lockerco_submit_post' AJAX endpoint. This mak… |
CVE-2025-65951 | High | 8.7 | 2025-11-25 | Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based timelock encryption system fails to enforc… |
CVE-2025-63958 | Critical | 9.8 | 2025-11-24 | MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without authentication. This pa… |
CVE-2025-13596 | | 2025-11-24 | A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When cer… | |
CVE-2025-13526 | High | 7.5 | 2025-11-22 | The OneClick Chat to Order plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.8 via the 'wa_order… |
CVE-2025-12039 | Medium | 5.3 | 2025-11-21 | The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.0.5 due to… |
CVE-2025-11368 | Medium | 5.3 | 2025-11-21 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. Thi… |
CVE-2025-52669 | Medium | 4.3 | 2025-11-20 | Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the con… |
CVE-2025-63212 | Medium | 6.5 | 2025-11-19 | GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, including models LX100, LX300, LX600, and LX1000, expose sensitive session identifiers (sid) in the pub… |
CVE-2025-63209 | High | 7.5 | 2025-11-19 | The ELCA Star Transmitter Remote Control firmware 1.25 for STAR150, BP1000, STAR300, STAR2000, STAR1000, STAR500, and possibly other models, contains an inform… |
CVE-2025-63205 | High | 7.5 | 2025-11-19 | An issue was discovered in bridgetech probes VB220 IP Network Probe,VB120 Embedded IP + RF Probe, VB330 High-Capacity Probe, VB440 ST 2110 Production Analytics… |
CVE-2025-12426 | Medium | 5.3 | 2025-11-19 | The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is due to the plugin e… |
CVE-2025-12770 | Medium | 5.3 | 2025-11-19 | The New User Approve plugin for WordPress is vulnerable to unauthorized data disclosure in all versions up to, and including, 3.0.9 due to insufficient API key… |
CVE-2025-64324 | High | 7.7 | 2025-11-18 | KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user w… |
CVE-2025-37160 | Medium | 5.3 | 2025-11-18 | A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sens… |
CVE-2025-54971 | Medium | 4.3 | 2025-11-18 | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, F… |
CVE-2025-12545 | Medium | 5.3 | 2025-11-18 | The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Information Exposure in… |
CVE-2025-63891 | High | 7.5 | 2025-11-14 | Information Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store System allows a remote unauthenticated attacker to disclose ful… |
CVE-2025-54345 | High | 7.5 | 2025-11-14 | An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. Sensitive Information is exposed to an Unauthorized Actor. |
CVE-2025-12149 | | 2025-11-14 | In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, when the search is triggered from a Signal… | |
CVE-2025-11794 | Medium | 4.9 | 2025-11-14 | Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password… |
CVE-2025-12785 | High | 7.5 | 2025-11-13 | Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/o… |
CVE-2025-12784 | Medium | 4.9 | 2025-11-13 | Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/o… |
CVE-2025-64703 | Medium | 6.3 | 2025-11-13 | MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can get sensitive informations by Python code in tool module, although… |
CVE-2025-12681 | Medium | 5.3 | 2025-11-13 | The Comment Edit Core – Simple Comment Editing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.0… |
CVE-2025-64705 | Medium | 4.3 | 2025-11-12 | Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, users were able to access… |
CVE-2025-20379 | Low | 3.5 | 2025-11-12 | In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2… |
CVE-2025-12732 | Medium | 4.3 | 2025-11-12 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing aut… |
CVE-2025-62206 | Medium | 6.5 | 2025-11-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over… |
CVE-2025-59240 | Medium | 5.5 | 2025-11-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2025-11697 | | 2025-11-11 | A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to… | |
CVE-2017-20210 | Critical | 9.8 | 2025-11-11 | Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research. |
CVE-2025-12010 | Medium | 6.5 | 2025-11-11 | The Authors List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.6.1 via the via arbitrary metho… |
CVE-2025-11997 | Medium | 5.3 | 2025-11-11 | The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1… |
CVE-2025-12098 | Medium | 5.3 | 2025-11-08 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up… |
CVE-2025-64179 | Medium | 5.3 | 2025-11-06 | lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/… |
CVE-2025-55342 | Medium | 5.3 | 2025-11-05 | Quipux 4.0.1 through e1774ac allows enumeration of usernames, and accessing the Ecuadorean identification number for all registered users via the Administracio… |
CVE-2025-59716 | Medium | 5.3 | 2025-11-05 | ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validatio… |
CVE-2025-20377 | Medium | 4.3 | 2025-11-05 | A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an… |
CVE-2025-12468 | Medium | 5.3 | 2025-11-05 | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure… |
CVE-2025-12677 | Medium | 5.3 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the register_api_route()… |
CVE-2025-12139 | High | 7.5 | 2025-11-05 | The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress is vulnerable to sensitive information exposure in all versions… |
CVE-2025-11749 | Critical | 9.8 | 2025-11-05 | The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoi… |
CVE-2025-62721 | Medium | 6.5 | 2025-11-04 | LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, authenticated RSS feed endpoints in the FeedController class fail to im… |
CVE-2025-62720 | Medium | 6.5 | 2025-11-04 | LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire database of links from al… |
CVE-2025-60925 | Medium | 5.3 | 2025-11-04 | codeshare v1.0.0 was discovered to contain an information leakage vulnerability. |
CVE-2025-54323 | High | 7.5 | 2025-11-04 | An issue was discovered in the camera in Samsung Mobile Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, and 1580. Improper debu… |
CVE-2025-43495 | Medium | 5.4 | 2025-11-04 | The issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. An app may be able to monitor keys… |
CVE-2025-43479 | Medium | 5.5 | 2025-11-04 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may… |
CVE-2025-43460 | Medium | 4.6 | 2025-11-04 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.1 and iPadOS 26.1. An attacker with physical access to a locked device may be a… |
CVE-2025-43455 | Medium | 5.5 | 2025-11-04 | A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. A malicious… |
CVE-2025-43449 | High | 7.5 | 2025-11-04 | The issue was addressed with improved handling of caches. This issue is fixed in iOS 26.1 and iPadOS 26.1. A malicious app may be able to track users between i… |
CVE-2025-43411 | Medium | 5.5 | 2025-11-04 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be… |
CVE-2025-43391 | Medium | 5.5 | 2025-11-04 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14… |
CVE-2025-43378 | Medium | 5.5 | 2025-11-04 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to access sen… |
CVE-2025-43360 | Medium | 5.5 | 2025-11-04 | The issue was addressed with improved UI. This issue is fixed in iOS 26 and iPadOS 26. Password fields may be unintentionally revealed. |
CVE-2025-43345 | Medium | 5.5 | 2025-11-04 | A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma… |
CVE-2025-43323 | High | 8.1 | 2025-11-04 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An… |
CVE-2025-60892 | Medium | 6.8 | 2025-11-03 | An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature. The imager's 'public-key authentication' setting unintention… |
CVE-2025-12616 | Low | 3.7 | 2025-11-03 | A vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing a manipulatio… |
CVE-2025-11983 | Medium | 4.3 | 2025-11-01 | The WP Discourse plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5.9. This is due to the plugin unconditiona… |
CVE-2025-11377 | Medium | 4.3 | 2025-11-01 | The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due… |
CVE-2025-29270 | Critical | 10.0 | 2025-10-31 | Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin pan… |
CVE-2025-12521 | Medium | 5.3 | 2025-10-31 | The Analytify Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0.3 via the Analytify Tag HTML d… |
CVE-2025-34272 | Medium | 6.5 | 2025-10-30 | In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the application does not reliably fall back to an emp… |
CVE-2025-11998 | | 2025-10-30 | The following HP Card Readers B Models (X3D03B & Y7C05B) are potentially vulnerable to information disclosure, allowing prior user identity to be inherited und… | |
CVE-2025-54548 | Medium | 4.3 | 2025-10-29 | On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes) |
CVE-2025-11203 | Low | 3.5 | 2025-10-29 | LiteLLM Information health API_KEY Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affect… |
CVE-2025-12148 | | 2025-10-29 | In Search Guard versions 3.1.1 and earlier, Field Masking (FM) rules are improperly enforced on fields of type IP (IP Address). While the content of these fie… | |
CVE-2025-12147 | | 2025-10-29 | In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule… | |
CVE-2023-7320 | Medium | 5.3 | 2025-10-29 | The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to improper CORS handling on… |
CVE-2025-60805 | High | 7.5 | 2025-10-28 | An issue was discovered in BESSystem BES Application Server thru 9.5.x allowing unauthorized attackers to gain sensitive information via the "pre-resource" opt… |
CVE-2025-60858 | High | 7.5 | 2025-10-28 | Reolink Video Doorbell Wi-Fi DB_566128M5MP_W stores and transmits DDNS credentials in plaintext within its configuration and update scripts, allowing attackers… |
CVE-2025-62524 | Medium | 5.3 | 2025-10-27 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header… |
CVE-2025-12363 | High | 7.5 | 2025-10-27 | Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-27225 | High | 7.5 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint disclo… |
CVE-2025-12297 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in infor… |
CVE-2025-61482 | High | 7.2 | 2025-10-27 | Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root access to bypass two… |
CVE-2025-52268 | High | 7.5 | 2025-10-27 | StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens. |
CVE-2025-61481 | Critical | 10.0 | 2025-10-27 | An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to… |
CVE-2025-12276 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Affected by this issue is some unknown functionality of the componen… |
CVE-2025-11760 | Medium | 5.3 | 2025-10-25 | The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all vers… |
CVE-2025-11145 | High | 7.5 | 2025-10-24 | Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerabi… |
CVE-2025-54966 | Medium | 4.3 | 2025-10-23 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. Some endpoints on the SOCET GXP Job Status Service may return sensitive information in certain situati… |
CVE-2025-6980 | High | 7.5 | 2025-10-23 | Captive Portal can expose sensitive information |
CVE-2025-62400 | Medium | 4.3 | 2025-10-23 | Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or res… |
CVE-2025-62604 | High | 7.5 | 2025-10-22 | MeterSphere is an open source continuous testing platform. Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allo… |
CVE-2025-61885 | Medium | 4.3 | 2025-10-21 | Vulnerability in the Oracle Life Sciences InForm product of Oracle Health Sciences Applications (component: Web Server). The supported version that is affect… |
CVE-2025-61764 | Medium | 5.3 | 2025-10-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2025-61750 | Medium | 4.3 | 2025-10-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affected are 8.61 and 8.6… |
CVE-2025-53066 | High | 7.5 | 2025-10-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions… |
CVE-2025-53047 | Medium | 5.8 | 2025-10-21 | Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.28, 21.3-21.19 and 23.4-23.9… |
CVE-2025-53043 | High | 8.1 | 2025-10-21 | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.14… |
CVE-2025-53036 | High | 8.6 | 2025-10-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2025-50074 | Medium | 4.9 | 2025-10-21 | Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Security Management… |
CVE-2025-61220 | High | 7.5 | 2025-10-21 | The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to… |
CVE-2025-60344 | High | 8.6 | 2025-10-21 | A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used f… |