CWE-200 · Information Disclosure (page 22)
Page 22 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10222 | Low | 3.3 | 2025-09-10 | Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the diagnostic dump component in AxxonSoft Axxon One VMS (C-Werk) 2.0.0 through 2.0.1 o… |
CVE-2025-36759 | | 2025-09-10 | Through the provision of user names, SolaX Cloud will suggest (similar) user accounts and thereby leak sensitive information such as user email addresses and p… | |
CVE-2025-55052 | Medium | 4.3 | 2025-09-09 | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2025-29089 | High | 7.5 | 2025-09-09 | An issue in TP-Link AX10 Ax1500 v.1.3.10 Build (20230130) allows a remote attacker to obtain sensitive information |
CVE-2025-55243 | High | 7.5 | 2025-09-09 | Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-53804 | Medium | 5.5 | 2025-09-09 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-47997 | Medium | 6.5 | 2025-09-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information… |
CVE-2025-33045 | High | 8.2 | 2025-09-09 | APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unautho… |
CVE-2025-59019 | Medium | 4.3 | 2025-09-09 | Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclo… |
CVE-2025-59018 | Medium | 6.5 | 2025-09-09 | Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 all… |
CVE-2025-40803 | Low | 3.1 | 2025-09-09 | A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device exposes certain non-critical information from the… |
CVE-2025-40757 | Medium | 5.3 | 2025-09-09 | A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC Series (BACnet) (All… |
CVE-2025-58752 | Medium | 5.3 | 2025-09-08 | Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of… |
CVE-2025-58751 | Medium | 5.3 | 2025-09-08 | Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public direc… |
CVE-2025-22956 | Critical | 9.8 | 2025-09-08 | OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients. This can lead to privilege escalation if any ProductP… |
CVE-2025-10093 | Medium | 5.3 | 2025-09-08 | A vulnerability was identified in D-Link DIR-852 up to 1.00CN B09. Affected by this vulnerability is the function phpcgi_main of the file /getcfg.php of the co… |
CVE-2025-58445 | High | 7.5 | 2025-09-06 | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed ver… |
CVE-2025-7368 | Medium | 5.3 | 2025-09-06 | The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to Information Exposure in all versions up to, and inc… |
CVE-2025-55242 | Medium | 6.5 | 2025-09-04 | Exposure of sensitive information to an unauthorized actor in Xbox allows an unauthorized attacker to disclose information over a network. |
CVE-2025-55190 | Critical | 9.9 | 2025-09-04 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3… |
CVE-2025-48527 | Medium | 6.2 | 2025-09-04 | In multiple locations, there is a possible way to leak hidden work profile notifications due to a logic error in the code. This could lead to local information… |
CVE-2025-26453 | Medium | 5.5 | 2025-09-04 | In isContentUriForOtherUser of BluetoothOppSendFileInfo.java, there is a possible cross user data leak due to a logic error in the code. This could lead to loc… |
CVE-2025-6984 | High | 7.5 | 2025-09-04 | The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing… |
CVE-2025-36895 | High | 7.5 | 2025-09-04 | Information disclosure |
CVE-2025-20336 | Medium | 5.3 | 2025-09-03 | A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an un… |
CVE-2025-20270 | Medium | 4.3 | 2025-09-03 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authen… |
CVE-2025-58458 | Medium | 4.3 | 2025-09-03 | In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path… |
CVE-2025-53694 | High | 7.5 | 2025-09-03 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This i… |
CVE-2025-9843 | Medium | 5.3 | 2025-09-03 | A flaw has been found in Das Parking Management System 停车场管理系统 6.2.0. Affected is an unknown function of the file /Operator/FindAll. This manipulation causes i… |
CVE-2025-9842 | Medium | 5.3 | 2025-09-03 | A vulnerability was detected in Das Parking Management System 停车场管理系统 6.2.0. This impacts an unknown function of the file /Operator/Search. The manipulation re… |
CVE-2025-22430 | Medium | 5.5 | 2025-09-02 | In isInSignificantPlace of multiple files, there is a possible way to access sensitive information due to a missing permission check. This could lead to local… |
CVE-2025-9774 | Medium | 4.3 | 2025-09-01 | A vulnerability has been found in RemoteClinic up to 2.0. This issue affects some unknown processing of the file /patients/edit-patient.php. The manipulation o… |
CVE-2025-58061 | Medium | 5.5 | 2025-08-28 | OpenEBS Local PV RawFile allows dynamic deployment of Stateful Persistent Node-Local Volumes & Filesystems for Kubernetes. Prior to version 0.10.0, persistent… |
CVE-2025-58059 | Critical | 9.1 | 2025-08-28 | Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can… |
CVE-2025-57757 | Medium | 5.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items… |
CVE-2025-57756 | Medium | 5.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragmen… |
CVE-2025-51643 | Low | 2.4 | 2025-08-28 | Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper protection. An attacker… |
CVE-2024-13807 | High | 7.5 | 2025-08-28 | The Xagio SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.1.0.5 via the backup functionality d… |
CVE-2025-20290 | Medium | 5.5 | 2025-08-27 | A vulnerability in the logging feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches, Cisco Nexus 9000 Series Switches in standalone NX-OS mode… |
CVE-2024-39335 | Critical | 9.1 | 2025-08-26 | Supported versions of Mahara 24.04 before 24.04.1 and 23.04 before 23.04.6 are vulnerable to information being disclosed to an institution administrator under… |
CVE-2025-29992 | High | 7.5 | 2025-08-26 | Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being temporarily down or t… |
CVE-2025-9461 | Medium | 4.3 | 2025-08-26 | A weakness has been identified in diyhi bbs up to 6.8. The impacted element is an unknown function of the file src/main/java/cms/web/action/filePackage/FilePac… |
CVE-2023-47799 | High | 7.5 | 2025-08-25 | Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or vi… |
CVE-2025-7426 | | 2025-08-25 | Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauthenticated remote ac… | |
CVE-2025-9398 | Medium | 5.3 | 2025-08-25 | A security vulnerability has been detected in YiFang CMS up to 2.0.5. Affected by this vulnerability is the function exportInstallTable of the file app/utils/b… |
CVE-2025-9381 | Low | 1.6 | 2025-08-24 | A security flaw has been discovered in FNKvision Y215 CCTV Camera 10.194.120.40. This affects an unknown part of the file /tmp/wpa_supplicant.conf. Performing… |
CVE-2025-57755 | | 2025-08-21 | claude-code-router is a powerful tool to route Claude Code requests to different models and customize any request. Due to improper Cross-Origin Resource Sharin… | |
CVE-2025-9240 | Medium | 4.3 | 2025-08-20 | A security flaw has been discovered in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file /auth/info. The manipulation… |
CVE-2025-20345 | Medium | 4.9 | 2025-08-20 | A vulnerability in the debug logging function of Cisco Duo Authentication Proxy could allow an authenticated, high-privileged, remote attacker to view sensitiv… |
CVE-2025-8448 | | 2025-08-20 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when… | |
CVE-2025-9139 | Medium | 4.3 | 2025-08-19 | A vulnerability was determined in Scada-LTS 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/dwr/call/plaincall/Watch… |
CVE-2025-7654 | High | 8.8 | 2025-08-19 | Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wf_get_cookie shortcode. This makes it possible for authenticated attackers… |
CVE-2025-54118 | Medium | 5.3 | 2025-08-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Sensitive information disclosure in NamelessMC before 2.2.4 allows unauthe… |
CVE-2024-12575 | Medium | 5.3 | 2025-08-16 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and includi… |
CVE-2025-43201 | Medium | 6.2 | 2025-08-15 | This issue was addressed with improved checks. This issue is fixed in Apple Music Classical 2.3 for Android. An app may be able to unexpectedly leak a user's c… |
CVE-2025-26709 | Medium | 5.7 | 2025-08-15 | There is an unauthorized access vulnerability in ZTE F50. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain s… |
CVE-2025-8091 | Medium | 4.3 | 2025-08-15 | The EventON Lite plugin for WordPress is vulnerable to Information Exposure in all versions less than, or equal to, 2.4.6 via the add_single_eventon and add_ev… |
CVE-2025-9005 | Low | 3.7 | 2025-08-15 | A vulnerability was determined in mtons mblog up to 3.5.0. Affected is an unknown function of the file /register. The manipulation leads to information exposur… |
CVE-2025-8676 | Medium | 4.3 | 2025-08-15 | The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in versions less than, or equal to, 2.0.0 via… |
CVE-2025-50862 | Medium | 5.9 | 2025-08-14 | The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 has allowBackup=true set in its manifest, allowing data exfiltration via ADB backup on rooted or… |
CVE-2025-27845 | Critical | 9.8 | 2025-08-14 | In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret. This allows for e… |
CVE-2025-9036 | | 2025-08-14 | A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted over a WebSocket and… | |
CVE-2025-55673 | Medium | 4.3 | 2025-08-14 | When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contain… |
CVE-2025-43988 | High | 7.5 | 2025-08-13 | KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers to retrieve sensitive configuration data… |
CVE-2025-43986 | Critical | 9.8 | 2025-08-13 | An issue was discovered on KuWFi GC111 GC111-GL-LM321_V3.0_20191211 devices. The TELNET service is enabled by default and exposed over the WAN interface withou… |
CVE-2025-55165 | High | 8.2 | 2025-08-12 | Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the deb… |
CVE-2025-53781 | High | 7.7 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Azure Virtual Machines allows an authorized attacker to disclose information over a network. |
CVE-2025-53728 | Medium | 6.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over… |
CVE-2025-53156 | Medium | 5.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Storage Port Driver allows an authorized attacker to disclose information locally. |
CVE-2025-53136 | Medium | 5.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Windows NT OS Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-53134 | High | 7.0 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2025-50154 | Medium | 6.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-33051 | High | 7.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network. |
CVE-2025-27707 | Low | 2.6 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may… |
CVE-2025-3831 | High | 8.1 | 2025-08-12 | Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties. |
CVE-2025-40768 | High | 7.3 | 2025-08-12 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application exposes an internal service… |
CVE-2025-4390 | Medium | 5.3 | 2025-08-12 | The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validate_… |
CVE-2025-8866 | | 2025-08-11 | YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit th… | |
CVE-2025-8852 | Medium | 4.3 | 2025-08-11 | A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Han… |
CVE-2025-55009 | High | 7.1 | 2025-08-09 | The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In versions 0.14.1 and b… |
CVE-2025-55008 | High | 7.1 | 2025-08-09 | The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1… |
CVE-2025-8738 | Medium | 5.3 | 2025-08-08 | A vulnerability has been found in zlt2000 microservices-platform up to 6.0.0 and classified as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-58257 | Medium | 5.7 | 2025-08-08 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. |
CVE-2024-58256 | Medium | 4.5 | 2025-08-08 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. |
CVE-2024-58255 | Medium | 5.0 | 2025-08-08 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. |
CVE-2025-54786 | Medium | 5.3 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authenticati… |
CVE-2025-46659 | High | 7.5 | 2025-08-06 | An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. Information disclosure can occur via an external HTTPS request. |
CVE-2025-38746 | Low | 3.5 | 2025-08-06 | Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenti… |
CVE-2025-30127 | Critical | 9.8 | 2025-08-06 | An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. Once access is gained either by default, common, or cracked passwords, the video recordings… |
CVE-2025-51040 | High | 7.5 | 2025-08-06 | Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability via the /FrameSetCore.html endpoint in Electrolink 500W, 1kW, 2kW Med… |
CVE-2025-46388 | Medium | 4.3 | 2025-08-06 | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2025-8620 | Medium | 5.3 | 2025-08-06 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. T… |
CVE-2025-54615 | Medium | 6.2 | 2025-08-06 | Vulnerability of insufficient information protection in the media library module. Impact: Successful exploitation of this vulnerability may affect service conf… |
CVE-2025-29745 | High | 7.5 | 2025-08-05 | A vulnerability affecting the scanning module in Emsisoft Anti-Malware prior to 2024.12 allows attackers on a remote server to obtain Net-NTLMv2 hash informati… |
CVE-2025-8548 | Low | 3.7 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/… |
CVE-2025-8525 | Medium | 5.3 | 2025-08-04 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/S… |
CVE-2025-8519 | Low | 2.7 | 2025-08-04 | A vulnerability classified as problematic has been found in givanz Vvveb up to 1.0.5. This affects an unknown part of the file /vadmin123/index.php?module=edit… |
CVE-2025-8515 | Low | 3.1 | 2025-08-04 | A weakness has been identified in Intelbras InControl 2.21.60.9. This vulnerability affects unknown code of the file /v1/operador/ of the component JSON Endpoi… |
CVE-2025-23290 | Low | 2.5 | 2025-08-02 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a guest could get global GPU metrics which may be influenced by work in other V… |
CVE-2025-6722 | Medium | 5.3 | 2025-08-02 | The BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up… |