CWE-200 · Information Disclosure (page 23)
Page 23 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54133 | Critical | 9.6 | 2025-08-02 | Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP (Model… |
CVE-2025-4523 | Medium | 6.5 | 2025-08-01 | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability… |
CVE-2025-54586 | High | 7.1 | 2025-07-30 | GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can inject extra commits into th… |
CVE-2025-45620 | High | 8.1 | 2025-07-30 | An issue in Aver PTC310UV2 v.0.1.0000.59 allows a remote attacker to obtain sensitive information via a crafted request |
CVE-2025-43018 | Medium | 5.3 | 2025-07-30 | Certain HP LaserJet Pro printers may be vulnerable to information disclosure when a non-authenticated user queries a device’s local address book. |
CVE-2025-54425 | Medium | 5.3 | 2025-07-30 | Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through 16.1.0, the content delivery API can be restricted from… |
CVE-2025-4426 | Medium | 6.0 | 2025-07-30 | The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for… |
CVE-2025-43246 | Medium | 5.5 | 2025-07-30 | This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to access sensitive user data. |
CVE-2025-43215 | Medium | 5.5 | 2025-07-30 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may result in disclosure of pro… |
CVE-2025-43189 | Critical | 9.8 | 2025-07-30 | This issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to read ker… |
CVE-2025-31279 | Critical | 9.8 | 2025-07-30 | A permissions issue was addressed with additional restrictions. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13… |
CVE-2025-50738 | Critical | 9.8 | 2025-07-29 | The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an imag… |
CVE-2025-8226 | Medium | 4.3 | 2025-07-27 | A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been classified as problematic. Affected is an unknown function of the file /sysApp/find… |
CVE-2025-54380 | Medium | 6.5 | 2025-07-26 | Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly se… |
CVE-2025-29629 | Critical | 9.1 | 2025-07-25 | Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for… |
CVE-2025-29628 | Critical | 9.4 | 2025-07-25 | A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Applicat… |
CVE-2025-3508 | Medium | 6.5 | 2025-07-25 | Certain HP DesignJet products may be vulnerable to information disclosure though printer's web interface allowing unauthenticated users to view sensitive print… |
CVE-2020-36850 | | 2025-07-25 | An information disclosure vulnerability exits in Sitecore JSS React Sample Application 11.0.0 - 14.0.1 that may cause page content intended for one user to be… | |
CVE-2025-30086 | Medium | 4.9 | 2025-07-25 | CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/… |
CVE-2025-31955 | High | 7.6 | 2025-07-24 | HCL iAutomate is affected by a sensitive data exposure vulnerability. This issue may allow unauthorized access to sensitive information within the system. |
CVE-2025-7780 | Medium | 6.5 | 2025-07-24 | The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4. The simpleTranscribeAudio endpo… |
CVE-2025-8039 | High | 8.1 | 2025-07-22 | In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 1… |
CVE-2025-6082 | Medium | 5.3 | 2025-07-22 | The Birth Chart Compatibility plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to insufficient… |
CVE-2025-52372 | Medium | 5.1 | 2025-07-21 | An issue in hMailServer v.5.8.6 allows a local attacker to obtain sensitive information via the hmailserver/installation/hMailServerInnoExtension.iss and hMail… |
CVE-2025-7919 | Medium | 6.5 | 2025-07-21 | WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL com… |
CVE-2025-46382 | Medium | 5.3 | 2025-07-20 | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2025-7874 | Medium | 5.3 | 2025-07-20 | A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2025-7394 | Critical | 9.8 | 2025-07-18 | In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to the potential for predictable values re… |
CVE-2025-50708 | High | 7.5 | 2025-07-18 | An issue in Perplexity AI GPT-4 v.2.51.0 allows a remote attacker to obtain sensitive information via the token component in the shared chat URL |
CVE-2024-42209 | Low | 3.5 | 2025-07-17 | HCL Connections is vulnerable to an information disclosure vulnerability that could allow a user to obtain sensitive information they are not entitled to, whic… |
CVE-2025-3415 | Medium | 4.3 | 2025-07-17 | Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed… |
CVE-2025-34130 | | 2025-07-16 | An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html… | |
CVE-2025-53840 | Low | 2.4 | 2025-07-16 | Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependenc… |
CVE-2025-22227 | Medium | 6.1 | 2025-07-16 | In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been exp… |
CVE-2025-30758 | Medium | 5.3 | 2025-07-15 | Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: User Interface). Supported versions that are affected are 25.0-25.5. Easily… |
CVE-2025-53887 | Medium | 5.3 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus vers… |
CVE-2025-53886 | Medium | 4.5 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flo… |
CVE-2025-53640 | Medium | 6.5 | 2025-07-14 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3… |
CVE-2024-51769 | High | 7.5 | 2025-07-14 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2025-7573 | Medium | 5.3 | 2025-07-14 | A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 202… |
CVE-2025-7572 | Medium | 5.3 | 2025-07-14 | A vulnerability classified as critical was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This vulne… |
CVE-2025-7565 | Medium | 5.3 | 2025-07-14 | A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/light… |
CVE-2020-36848 | High | 7.5 | 2025-07-12 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versi… |
CVE-2025-6745 | Medium | 5.3 | 2025-07-11 | The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via the woodmart_get_posts_by_query() funct… |
CVE-2025-4593 | Medium | 6.5 | 2025-07-11 | The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the… |
CVE-2025-34098 | | 2025-07-10 | A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper input validation in the log filtering… | |
CVE-2025-52473 | Medium | 5.9 | 2025-07-10 | liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Multiple secret-dependent branches have bee… |
CVE-2025-53624 | Critical | 10.0 | 2025-07-09 | The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions pri… |
CVE-2025-53512 | Medium | 6.5 | 2025-07-08 | The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitiv… |
CVE-2025-49671 | Medium | 6.5 | 2025-07-08 | Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose info… |
CVE-2025-49664 | Medium | 5.5 | 2025-07-08 | Exposure of sensitive information to an unauthorized actor in Windows User-Mode Driver Framework Host allows an authorized attacker to disclose information loc… |
CVE-2025-48808 | Medium | 5.5 | 2025-07-08 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-47980 | Medium | 6.2 | 2025-07-08 | Exposure of sensitive information to an unauthorized actor in Windows Imaging Component allows an unauthorized attacker to disclose information locally. |
CVE-2025-20325 | Low | 3.1 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the… |
CVE-2025-34072 | | 2025-07-02 | A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. When an AI agent usi… | |
CVE-2024-13451 | Medium | 5.3 | 2025-07-02 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2025-49741 | High | 7.4 | 2025-07-01 | No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-6600 | Medium | 4.3 | 2025-07-01 | An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an attacker to disclose the names of private rep… |
CVE-2025-34064 | | 2025-07-01 | A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without… | |
CVE-2025-34062 | | 2025-07-01 | An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with ac… | |
CVE-2025-34059 | | 2025-07-01 | An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLog… | |
CVE-2025-34051 | | 2025-07-01 | A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_q… | |
CVE-2025-53003 | | 2025-07-01 | The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verif… | |
CVE-2025-52898 | High | 8.8 | 2025-06-30 | Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting ac… |
CVE-2025-49845 | High | 7.5 | 2025-06-25 | Discourse is an open-source discussion platform. The visibility of posts typed `whisper` is controlled via the `whispers_allowed_groups` site setting. Only use… |
CVE-2025-27827 | High | 7.1 | 2025-06-24 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.2.0.3 could allow an unauthenticated attacker to conduct an informat… |
CVE-2025-6432 | High | 8.6 | 2025-06-24 | When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not respondin… |
CVE-2025-6425 | Medium | 4.3 | 2025-06-24 | An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between cont… |
CVE-2025-39204 | Medium | 6.5 | 2025-06-24 | A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. The filtering query in the Web interface can be malformed, so returning data ca… |
CVE-2023-47029 | Critical | 9.8 | 2025-06-23 | An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted POST request to the… |
CVE-2023-47298 | Medium | 4.3 | 2025-06-23 | An issue in NCR Terminal Handler 1.5.1 allows a low-level privileged authenticated attacker to query the SOAP API endpoint to obtain information about all of t… |
CVE-2025-27387 | High | 7.4 | 2025-06-23 | OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure. |
CVE-2025-52488 | High | 8.6 | 2025-06-21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM… |
CVE-2025-25037 | | 2025-06-20 | An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpo… | |
CVE-2025-52467 | Critical | 9.1 | 2025-06-19 | pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to commit 8eb3567, the pgai repository was… |
CVE-2025-23173 | High | 7.5 | 2025-06-19 | The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify… |
CVE-2025-49593 | Medium | 6.8 | 2025-06-17 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and… |
CVE-2025-49824 | | 2025-06-17 | conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.4… | |
CVE-2025-6199 | Low | 3.3 | 2025-06-17 | A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output… |
CVE-2025-49177 | Medium | 6.1 | 2025-06-17 | A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended… |
CVE-2025-49200 | Medium | 6.5 | 2025-06-12 | The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup fil… |
CVE-2025-49184 | High | 7.5 | 2025-06-12 | A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product. |
CVE-2025-49150 | Medium | 5.9 | 2025-06-11 | Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by… |
CVE-2025-4798 | Medium | 4.9 | 2025-06-11 | The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due to a lack of restri… |
CVE-2025-30675 | Medium | 4.7 | 2025-06-11 | In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue b… |
CVE-2025-26521 | High | 8.1 | 2025-06-10 | When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin' user of the calle… |
CVE-2025-43579 | Medium | 5.5 | 2025-06-10 | Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an Information Exposure vulnerability that could result in a Secur… |
CVE-2025-47969 | Medium | 4.4 | 2025-06-10 | Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized attacker to disclose information locally. |
CVE-2025-25250 | Medium | 4.3 | 2025-06-10 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, For… |
CVE-2025-49143 | Medium | 5.9 | 2025-06-10 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIA_ROOT director… |
CVE-2024-38524 | Medium | 5.3 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletReques… |
CVE-2024-34711 | Critical | 9.3 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unautho… |
CVE-2025-40662 | High | 7.5 | 2025-06-10 | Absolute path disclosure vulnerability in DM Corporative CMS. This vulnerability allows an attacker to view the contents of webroot/file, if navigating to a no… |
CVE-2025-49653 | High | 8.0 | 2025-06-09 | Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform. |
CVE-2025-25209 | Medium | 5.7 | 2025-06-09 | The AuthPolicy metadata on Red Hat Connectivity Link contains an object which stores secretes, however it assumes those secretes are already in the kuadrant-sy… |
CVE-2025-47966 | Critical | 9.8 | 2025-06-05 | Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-5690 | Medium | 6.5 | 2025-06-04 | PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data… |
CVE-2025-20129 | Medium | 4.3 | 2025-06-04 | A vulnerability in the web-based chat interface of Cisco Customer Collaboration Platform (CCP), formerly Cisco SocialMiner, could allow an unauthenticated, rem… |
CVE-2025-5436 | Medium | 5.3 | 2025-06-02 | A vulnerability was found in Multilaser Sirius RE016 MLT1.0. It has been rated as problematic. This issue affects some unknown processing of the file /cgi-bin/… |
CVE-2025-4659 | Medium | 5.3 | 2025-05-30 | The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full Path Disclosure in al… |