CWE-200 · Information Disclosure (page 3)
Page 3 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-94185 | Medium | 5.5 | 2026-09-21 | nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto th… |
CVE-2026-94050 | Medium | 4.3 | 2026-09-20 | A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_get/routerd.get_rand_key of the compone… |
CVE-2026-93971 | Medium | 5.3 | 2026-09-20 | A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. Impacted is an unknown function of the file backend/sxdevops/settings.py. This manipulation cause… |
CVE-2026-92423 | Low | 2.7 | 2026-09-20 | The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returni… |
CVE-2026-9289 | Medium | 5.3 | 2026-09-19 | The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via t… |
CVE-2026-1255 | High | 7.5 | 2026-09-19 | The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captu… |
CVE-2026-92404 | High | 7.5 | 2026-09-19 | The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve th… |
CVE-2026-16557 | Medium | 4.3 | 2026-09-19 | The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJA… |
CVE-2026-92708 | High | 7.5 | 2026-09-18 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, s… |
CVE-2026-63646 | | 2026-09-18 | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/{formKey}… | |
CVE-2026-93685 | Medium | 5.4 | 2026-09-18 | A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in th… |
CVE-2026-56597 | Low | 3.1 | 2026-09-18 | HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal I… |
CVE-2026-67100 | Critical | 9.8 | 2026-09-18 | HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attac… |
CVE-2026-89278 | Medium | 5.3 | 2026-09-18 | The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Expo… |
CVE-2026-89008 | Low | 2.7 | 2026-09-18 | The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions… |
CVE-2026-84903 | Low | 2.7 | 2026-09-18 | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of… |
CVE-2026-93385 | Medium | 6.5 | 2026-09-17 | Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium… |
CVE-2026-93383 | Medium | 4.3 | 2026-09-17 | Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-54565 | Medium | 4.7 | 2026-09-17 | rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions… |
CVE-2026-45726 | High | 7.6 | 2026-09-17 | Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an Impor… |
CVE-2026-54649 | | 2026-09-17 | punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers in… | |
CVE-2026-54617 | Critical | 9.8 | 2026-09-17 | GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request targe… |
CVE-2026-92927 | Medium | 5.3 | 2026-09-17 | A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /db/drug_recommendor.sql. Pe… |
CVE-2026-85717 | Medium | 6.8 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and… |
CVE-2026-75523 | Medium | 5.9 | 2026-09-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Manag… |
CVE-2026-69197 | | 2026-09-17 | Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested nod… | |
CVE-2026-80356 | High | 7.3 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A low p… |
CVE-2026-63461 | Medium | 5.3 | 2026-09-17 | Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibilit… |
CVE-2026-92960 | Critical | 10.0 | 2026-09-17 | vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity a… |
CVE-2026-92947 | Critical | 10.0 | 2026-09-17 | vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related alloc… |
CVE-2026-92933 | Medium | 5.8 | 2026-09-17 | vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy… |
CVE-2026-92917 | High | 7.5 | 2026-09-17 | Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, js… |
CVE-2026-92916 | High | 7.5 | 2026-09-17 | Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the… |
CVE-2026-44940 | Medium | 5.7 | 2026-09-17 | The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them… |
CVE-2026-87836 | Low | 2.7 | 2026-09-17 | The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to con… |
CVE-2026-86446 | Low | 3.7 | 2026-09-17 | The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attack… |
CVE-2026-61588 | Medium | 6.5 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django `Model` in… |
CVE-2026-92594 | High | 7.5 | 2026-09-16 | Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-dat… |
CVE-2026-64684 | Medium | 6.8 | 2026-09-16 | RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common… |
CVE-2026-92811 | Medium | 6.5 | 2026-09-16 | browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders t… |
CVE-2026-92770 | Medium | 6.5 | 2026-09-16 | Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit… |
CVE-2026-20360 | High | 8.8 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive inter… |
CVE-2026-87076 | Medium | 6.5 | 2026-09-16 | Tanium addressed an information disclosure vulnerability in Discover. |
CVE-2026-81870 | | 2026-09-16 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal I… | |
CVE-2026-76825 | High | 8.4 | 2026-09-16 | RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPyth… |
CVE-2026-92357 | Medium | 4.3 | 2026-09-16 | A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processo… |
CVE-2026-87907 | Medium | 5.3 | 2026-09-16 | The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category r… |
CVE-2026-87896 | Medium | 5.3 | 2026-09-16 | The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records… |
CVE-2026-87854 | Medium | 5.3 | 2026-09-16 | The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing un… |
CVE-2026-86449 | Medium | 5.3 | 2026-09-16 | The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST rout… |
CVE-2026-86448 | Low | 3.7 | 2026-09-16 | The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export… |
CVE-2026-86447 | Medium | 5.3 | 2026-09-16 | The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attack… |
CVE-2026-86445 | Medium | 5.3 | 2026-09-16 | The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated a… |
CVE-2026-85572 | Medium | 4.3 | 2026-09-16 | The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any aut… |
CVE-2026-85349 | Medium | 4.3 | 2026-09-16 | The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authe… |
CVE-2026-82124 | Medium | 5.3 | 2026-09-16 | The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the… |
CVE-2026-78474 | Medium | 5.3 | 2026-09-16 | The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines… |
CVE-2026-88065 | High | 7.5 | 2026-09-15 | `tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Con… |
CVE-2026-87225 | High | 7.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87221 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87209 | High | 7.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87127 | High | 7.7 | 2026-09-15 | Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). Supported versions that are affected are 12.2.10-12.2.15… |
CVE-2026-83443 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Assets product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.1… |
CVE-2026-83437 | High | 7.7 | 2026-09-15 | Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12… |
CVE-2026-83425 | High | 8.5 | 2026-09-15 | Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions t… |
CVE-2026-83424 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affected are 12.2.1.4.0… |
CVE-2026-83419 | Medium | 5.4 | 2026-09-15 | Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP). Supported vers… |
CVE-2026-83417 | High | 7.1 | 2026-09-15 | Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP). Supported vers… |
CVE-2026-83414 | Low | 2.5 | 2026-09-15 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.1.1.0.0. Difficult… |
CVE-2026-83354 | Medium | 6.3 | 2026-09-15 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.1.1.0.0. Difficult… |
CVE-2026-83352 | High | 7.1 | 2026-09-15 | Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easi… |
CVE-2026-83326 | High | 7.5 | 2026-09-15 | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.7. E… |
CVE-2026-83302 | High | 8.5 | 2026-09-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). The supported version that is affected is 12.2.1.4.0… |
CVE-2026-83300 | High | 7.1 | 2026-09-15 | Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easi… |
CVE-2026-83287 | High | 7.7 | 2026-09-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). Supported versions that a… |
CVE-2026-83279 | Medium | 5.5 | 2026-09-15 | Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. E… |
CVE-2026-83277 | High | 7.3 | 2026-09-15 | Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. E… |
CVE-2026-83274 | Medium | 5.5 | 2026-09-15 | Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. E… |
CVE-2026-83259 | High | 7.1 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83238 | High | 7.1 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83237 | High | 7.1 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83175 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-1… |
CVE-2026-83167 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-1… |
CVE-2026-83116 | High | 7.7 | 2026-09-15 | Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected ar… |
CVE-2026-76707 | Medium | 4.3 | 2026-09-15 | A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to view some system memory contents. Successful… |
CVE-2026-76706 | Medium | 5.3 | 2026-09-15 | A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive inform… |
CVE-2026-76697 | Medium | 6.5 | 2026-09-15 | A vulnerability in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways could allow a remote attacker authenticated with low privil… |
CVE-2026-76692 | High | 7.1 | 2026-09-15 | A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to obtain limited information from memory and di… |
CVE-2026-76672 | Critical | 9.9 | 2026-09-15 | A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with r… |
CVE-2026-69212 | Medium | 5.9 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers onl… |
CVE-2026-56882 | High | 8.8 | 2026-09-15 | In Cellular Modem, there is a possible information disclosure due to a logic error in the code. This could lead to remote code execution with no additional exe… |
CVE-2026-0197 | Medium | 4.4 | 2026-09-15 | In VPU, there is a possible information dislclosure due to a logic error in the code. This could lead to local information disclosure with System execution pri… |
CVE-2026-54689 | Medium | 6.3 | 2026-09-15 | mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_re… |
CVE-2026-91992 | Medium | 5.9 | 2026-09-15 | Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clear… |
CVE-2026-91985 | High | 7.5 | 2026-09-15 | Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the sh… |
CVE-2026-91981 | Medium | 4.3 | 2026-09-15 | Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumer… |
CVE-2026-91980 | Medium | 4.3 | 2026-09-15 | vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers… |
CVE-2026-91965 | High | 7.5 | 2026-09-15 | WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticate… |
CVE-2026-87792 | | 2026-09-15 | The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator function… | |
CVE-2026-55178 | High | 7.5 | 2026-09-15 | GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints a… |