CWE-200 · Information Disclosure (page 24)
Page 24 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31231 | Medium | 5.5 | 2025-05-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to read sensitive location inform… |
CVE-2025-47288 | Low | 3.5 | 2025-05-29 | Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted to a public topic… |
CVE-2025-5334 | High | 7.5 | 2025-05-29 | Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated us… |
CVE-2025-5281 | Medium | 5.4 | 2025-05-27 | Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially obtain user information via a crafted… |
CVE-2025-5064 | Medium | 5.4 | 2025-05-27 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2024-56193 | Medium | 5.1 | 2025-05-27 | There is a possible disclosure of Bluetooth adapter details due to a permissions bypass. This could lead to local information disclosure with no additional exe… |
CVE-2025-5266 | Medium | 4.3 | 2025-05-27 | Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability was fixed… |
CVE-2025-5184 | Medium | 4.3 | 2025-05-26 | A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. It has been classified as problematic. Affected is an unknown… |
CVE-2025-5098 | Critical | 9.1 | 2025-05-23 | PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account without proper authoriza… |
CVE-2024-54188 | Medium | 5.3 | 2025-05-22 | Infoblox NETMRI before 7.6.1 has a vulnerability allowing remote authenticated users to read arbitrary files with root access. |
CVE-2025-48064 | Low | 3.3 | 2025-05-21 | GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view… |
CVE-2025-4980 | Medium | 5.3 | 2025-05-20 | A vulnerability has been found in Netgear DGND3700 1.1.00.15_1.00.15NA and classified as problematic. This vulnerability affects unknown code of the file /curr… |
CVE-2024-53359 | High | 7.5 | 2025-05-20 | An issue in Zalo v23.09.01 allows attackers to obtain sensitive user information via a crafted GET request. |
CVE-2025-4977 | Medium | 5.3 | 2025-05-20 | A vulnerability, which was classified as problematic, has been found in Netgear DGND3700 1.1.00.15_1.00.15NA. Affected by this issue is some unknown functional… |
CVE-2025-41230 | High | 7.5 | 2025-05-20 | VMware Cloud Foundation contains an information disclosure vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may expl… |
CVE-2025-4904 | Medium | 5.3 | 2025-05-19 | A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. This vulnerability affects the function sub_41F0FC of th… |
CVE-2025-4902 | Medium | 5.3 | 2025-05-19 | A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected by this issue is the function sub_48F4F… |
CVE-2025-4901 | Medium | 4.3 | 2025-05-19 | A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected by this vulnerability is the function sub_41E304 of the… |
CVE-2024-13613 | High | 7.5 | 2025-05-17 | The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.3 via the 'uploads' directory. Thi… |
CVE-2025-4753 | Medium | 5.3 | 2025-05-16 | A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2025-4752 | Medium | 5.3 | 2025-05-16 | A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this vulnerability is an unknown functionali… |
CVE-2025-4751 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected is an unknown function of the file /index.da… |
CVE-2025-4750 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). This issue affects some unknown processing of th… |
CVE-2025-25370 | Medium | 4.6 | 2025-05-14 | An issue in realme GT 2 (RMX3311) running Android 14 with realme UI 5.0 allows a physically proximate attacker to obtain sensitive information via the show app… |
CVE-2024-57096 | Medium | 5.5 | 2025-05-14 | An issue in wps office before v.19302 allows a local attacker to obtain sensitive information via a crafted file. |
CVE-2025-26864 | High | 7.5 | 2025-05-14 | Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache Io… |
CVE-2025-26795 | High | 7.5 | 2025-05-14 | Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in Apache IoTDB JDBC driver. This i… |
CVE-2025-22895 | Medium | 5.5 | 2025-05-13 | Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated use… |
CVE-2025-20624 | Medium | 5.7 | 2025-05-13 | Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated use… |
CVE-2025-20611 | Medium | 4.7 | 2025-05-13 | Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated use… |
CVE-2025-20030 | Low | 2.6 | 2025-05-13 | Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated use… |
CVE-2025-20013 | Medium | 5.5 | 2025-05-13 | Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated use… |
CVE-2025-32703 | Medium | 5.5 | 2025-05-13 | Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally. |
CVE-2024-56526 | Medium | 4.9 | 2025-05-13 | An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error. |
CVE-2025-31256 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.5. Hot corner may unexpectedly reveal a user’s deleted notes. |
CVE-2025-31250 | Medium | 5.5 | 2025-05-12 | An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive… |
CVE-2025-31242 | Medium | 5.5 | 2025-05-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequo… |
CVE-2025-31236 | Medium | 5.5 | 2025-05-12 | An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive… |
CVE-2025-31225 | High | 7.1 | 2025-05-12 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.5 and iPadOS 18.5. Call history from deleted apps may still appear in s… |
CVE-2025-31220 | Medium | 5.5 | 2025-05-12 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6… |
CVE-2025-31218 | Medium | 6.2 | 2025-05-12 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to observe the hostnames of new network… |
CVE-2025-31207 | High | 7.7 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An app may be able to enumerate a user's installed apps. |
CVE-2025-24220 | Medium | 5.5 | 2025-05-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.9. An app may be able to read a pe… |
CVE-2025-24155 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able… |
CVE-2025-24144 | Medium | 5.5 | 2025-05-12 | An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.7, macOS Sequoia 15… |
CVE-2025-24142 | Medium | 5.5 | 2025-05-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventu… |
CVE-2025-4536 | Medium | 5.3 | 2025-05-11 | A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical. Affected by this vulnera… |
CVE-2025-4535 | Medium | 5.3 | 2025-05-11 | A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0. Affected is an unk… |
CVE-2025-4526 | Medium | 4.3 | 2025-05-11 | A vulnerability was identified in Dígitro NGC Explorer up to 3.48.21. The affected element is an unknown function of the component Configuration Page. Such man… |
CVE-2025-20221 | Medium | 5.3 | 2025-05-07 | A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and Layer 4… |
CVE-2025-3851 | Medium | 4.3 | 2025-05-07 | The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 t… |
CVE-2025-47418 | | 2025-05-06 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse. There is no visible indication w… | |
CVE-2025-47417 | | 2025-05-06 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse. When Enable Debug Images in Cr… | |
CVE-2025-46820 | High | 7.1 | 2025-05-06 | phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflo… |
CVE-2024-58252 | Medium | 6.2 | 2025-05-06 | Vulnerability of insufficient information protection in the media library module Impact: Successful exploitation of this vulnerability may affect service confi… |
CVE-2025-46813 | Medium | 5.8 | 2025-05-05 | Discourse is an open-source community platform. A data leak vulnerability affects sites deployed between commits 10df7fdee060d44accdee7679d66d778d1136510 and 8… |
CVE-2025-46720 | Low | 3.1 | 2025-05-05 | Keystone is a content management system for Node.js. Prior to version 6.5.0, `{field}.isFilterable` access control can be bypassed in `update` and `delete` mut… |
CVE-2025-4281 | Medium | 4.3 | 2025-05-05 | A vulnerability, which was classified as problematic, was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This affects an u… |
CVE-2025-4271 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-4270 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cg… |
CVE-2025-4222 | Medium | 5.9 | 2025-05-03 | The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored i… |
CVE-2025-46332 | Medium | 6.5 | 2025-05-02 | Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1… |
CVE-2025-2880 | Medium | 5.3 | 2025-05-02 | The Yame | Link In Bio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.0 through the publicly ac… |
CVE-2024-11994 | Medium | 5.7 | 2025-05-01 | APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, this could disclo… |
CVE-2023-46669 | Medium | 6.2 | 2025-05-01 | Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confidentiality and impersona… |
CVE-2025-46552 | | 2025-04-29 | KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on ver… | |
CVE-2025-24270 | Medium | 5.7 | 2025-04-29 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7… |
CVE-2025-3978 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in dazhouda lecms 3.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin/vie… |
CVE-2025-3975 | Medium | 5.3 | 2025-04-27 | A vulnerability was found in ScriptAndTools eCommerce-website-in-PHP 3.0 and classified as problematic. This issue affects some unknown processing of the file… |
CVE-2025-3966 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/hom… |
CVE-2025-32986 | High | 7.5 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint. |
CVE-2025-32983 | High | 7.5 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 allows Technical Information Disclosure via a Stack Trace. |
CVE-2025-3628 | Medium | 4.3 | 2025-04-25 | A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities. |
CVE-2025-32044 | High | 7.5 | 2025-04-25 | A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, an… |
CVE-2025-3923 | Medium | 5.3 | 2025-04-25 | The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2024-11299 | Medium | 5.3 | 2025-04-22 | The Memberpress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.37 via the WordPress core searc… |
CVE-2025-32958 | Critical | 9.8 | 2025-04-21 | Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the m… |
CVE-2025-23174 | High | 7.5 | 2025-04-21 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2025-32953 | High | 8.7 | 2025-04-18 | z80pack is a mature emulator of multiple platforms with 8080 and Z80 CPU. In version 1.38 and prior, the `makefile-ubuntu.yml` workflow file uses `actions/uplo… |
CVE-2025-28235 | High | 7.5 | 2025-04-18 | An information disclosure vulnerability in the component /socket.io/1/websocket/ of Soundcraft Ui Series Model(s) Ui12 and Ui16 Firmware v1.0.7x and v1.0.5x al… |
CVE-2025-29316 | Medium | 6.2 | 2025-04-17 | An issue in DataPatrol Screenshot watermark, printing watermark agent v.3.5.2.0 allows a physically proximate attacker to obtain sensitive information. NOTE: t… |
CVE-2025-32789 | Low | 3.1 | 2025-04-16 | EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an at… |
CVE-2025-3104 | Medium | 5.3 | 2025-04-16 | The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capabil… |
CVE-2025-30724 | High | 7.5 | 2025-04-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.6.0.0.0 and 12.2.1… |
CVE-2025-30702 | Medium | 5.3 | 2025-04-15 | Vulnerability in the Fleet Patching and amp; Provisioning component of Oracle Database Server. Supported versions that are affected are 19.3-19.26. Easily exp… |
CVE-2025-27980 | Medium | 6.5 | 2025-04-15 | cashbook v4.0.3 has an arbitrary file read vulnerability in /api/entry/flow/invoice/show?invoice=. |
CVE-2025-31494 | Low | 3.5 | 2025-04-15 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The AutoGPT Pl… |
CVE-2025-31491 | High | 8.6 | 2025-04-15 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1… |
CVE-2025-2881 | Medium | 5.3 | 2025-04-12 | The Developer Toolbar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 through the publicly acc… |
CVE-2025-2841 | Medium | 5.3 | 2025-04-12 | The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through the publicly accessib… |
CVE-2025-32080 | | 2025-04-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resour… | |
CVE-2024-52280 | High | 7.7 | 2025-04-11 | A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to acces… |
CVE-2025-23387 | Medium | 5.3 | 2025-04-11 | A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens… |
CVE-2024-52282 | Medium | 6.2 | 2025-04-11 | A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET access to the Rancher Manager Apps Cata… |
CVE-2025-32700 | | 2025-04-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program fil… | |
CVE-2025-32698 | | 2025-04-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files… | |
CVE-2025-32395 | | 2025-04-10 | Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the… | |
CVE-2025-30654 | Medium | 5.5 | 2025-04-09 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows… |
CVE-2025-30291 | Medium | 5.5 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass… |
CVE-2025-29805 | High | 7.5 | 2025-04-08 | Exposure of sensitive information to an unauthorized actor in Outlook for Android allows an unauthorized attacker to disclose information over a network. |