CWE-200 · Information Disclosure (page 4)
Page 4 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54254 | | 2026-09-15 | Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host matching instead of… | |
CVE-2026-49254 | | 2026-09-15 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and… | |
CVE-2026-92070 | Medium | 4.3 | 2026-09-15 | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
CVE-2026-92044 | High | 7.5 | 2026-09-15 | Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153… |
CVE-2026-92031 | Medium | 6.5 | 2026-09-15 | Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156… |
CVE-2026-45048 | High | 8.5 | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ow… |
CVE-2026-18232 | Medium | 5.3 | 2026-09-15 | The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public… |
CVE-2026-16592 | Low | 2.7 | 2026-09-15 | The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as… |
CVE-2026-15758 | Medium | 5.3 | 2026-09-15 | The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all version… |
CVE-2026-90881 | Medium | 5.3 | 2026-09-15 | A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Execut… |
CVE-2026-86895 | High | 7.5 | 2026-09-14 | An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. A… |
CVE-2026-86887 | Low | 3.3 | 2026-09-14 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be abl… |
CVE-2026-86883 | Medium | 5.5 | 2026-09-14 | A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27. An app may be able to access sensitive… |
CVE-2026-86878 | Medium | 5.5 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data. |
CVE-2026-84626 | Low | 3.3 | 2026-09-14 | An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Gold… |
CVE-2026-84625 | Critical | 9.1 | 2026-09-14 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS… |
CVE-2026-84586 | Medium | 5.5 | 2026-09-14 | An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, watchOS 27. A malicious application… |
CVE-2026-84583 | Medium | 5.5 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, ma… |
CVE-2026-84576 | Medium | 5.5 | 2026-09-14 | This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access… |
CVE-2026-84530 | Low | 3.3 | 2026-09-14 | An information disclosure issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Gol… |
CVE-2026-65371 | Low | 3.3 | 2026-09-14 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8, macOS Tahoe 26… |
CVE-2026-64761 | High | 7.5 | 2026-09-14 | A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to identify what othe… |
CVE-2026-43687 | Medium | 6.5 | 2026-09-14 | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe… |
CVE-2026-43664 | Medium | 5.5 | 2026-09-14 | This issue was addressed with improved data protection. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequ… |
CVE-2026-90811 | Low | 3.3 | 2026-09-14 | A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. This affects the function PermissionManager.checkShellCommand of the file mercury… |
CVE-2026-55837 | Medium | 6.8 | 2026-09-14 | dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /d… |
CVE-2026-56839 | High | 7.3 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_rep… |
CVE-2026-54529 | Medium | 5.3 | 2026-09-14 | SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortB… |
CVE-2026-47701 | High | 7.7 | 2026-09-14 | The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with target… |
CVE-2026-84179 | Medium | 6.5 | 2026-09-14 | Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in th… |
CVE-2026-90936 | Medium | 4.3 | 2026-09-14 | Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global s… |
CVE-2026-73178 | High | 7.5 | 2026-09-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can get access via RES… |
CVE-2026-90895 | | 2026-09-14 | Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsi… | |
CVE-2026-85188 | | 2026-09-14 | Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content… | |
CVE-2026-90503 | Low | 2.3 | 2026-09-13 | A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Exec… |
CVE-2026-88995 | Medium | 5.3 | 2026-09-13 | The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allo… |
CVE-2026-86407 | Low | 3.7 | 2026-09-13 | The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account… |
CVE-2026-77773 | Medium | 5.3 | 2026-09-13 | The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its pu… |
CVE-2026-90550 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before… |
CVE-2026-90549 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthe… |
CVE-2026-90548 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing una… |
CVE-2026-90541 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing una… |
CVE-2026-90539 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php en… |
CVE-2026-90538 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in playlistsFromUser.json.php that allows un… |
CVE-2026-90536 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint, allowing unauthenticated attackers t… |
CVE-2026-17585 | Medium | 5.3 | 2026-09-12 | The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up… |
CVE-2026-87916 | Medium | 5.3 | 2026-09-12 | The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenti… |
CVE-2026-87842 | High | 7.5 | 2026-09-12 | The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allow… |
CVE-2026-78152 | Medium | 5.3 | 2026-09-12 | The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages… |
CVE-2026-50025 | | 2026-09-11 | Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management bound… | |
CVE-2026-49463 | Medium | 6.5 | 2026-09-11 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizatio… |
CVE-2026-49462 | Medium | 5.3 | 2026-09-11 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizatio… |
CVE-2026-89298 | Medium | 4.9 | 2026-09-11 | A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user w… |
CVE-2026-89248 | Medium | 5.3 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebR… |
CVE-2026-14562 | Medium | 5.3 | 2026-09-11 | The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadat… |
CVE-2026-88059 | Medium | 4.0 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20… |
CVE-2026-88013 | Low | 3.7 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attach… |
CVE-2026-88893 | High | 7.5 | 2026-09-10 | OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated… |
CVE-2026-88876 | High | 7.5 | 2026-09-10 | AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unaut… |
CVE-2026-88874 | High | 7.5 | 2026-09-10 | AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream password check on the stats endpoint or… |
CVE-2026-19439 | High | 7.5 | 2026-09-10 | The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauth… |
CVE-2026-0305 | | 2026-09-10 | An information disclosure vulnerability in the Palo Alto Networks Prisma® Access Agent on Linux enables a local user to access sensitive configuration data and… | |
CVE-2026-87017 | Medium | 4.3 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the ca… |
CVE-2026-79323 | High | 7.5 | 2026-09-09 | Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unaut… |
CVE-2026-52482 | High | 7.5 | 2026-09-09 | An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service spawns /app/sh_for_tel… |
CVE-2026-86767 | Medium | 5.0 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, all… |
CVE-2026-87820 | Medium | 5.3 | 2026-09-09 | CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan ide… |
CVE-2026-87810 | Medium | 5.3 | 2026-09-09 | Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from res… |
CVE-2026-84222 | Medium | 5.3 | 2026-09-09 | The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowi… |
CVE-2026-81022 | Medium | 5.3 | 2026-09-09 | The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, a… |
CVE-2026-81021 | Medium | 5.3 | 2026-09-09 | The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauth… |
CVE-2026-80340 | Medium | 5.3 | 2026-09-09 | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configurat… |
CVE-2026-80339 | Medium | 5.3 | 2026-09-09 | The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configurat… |
CVE-2026-16960 | High | 7.5 | 2026-09-09 | The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthent… |
CVE-2026-87035 | Medium | 4.3 | 2026-09-09 | Tanium addressed an information disclosure vulnerability in Comply. |
CVE-2026-87032 | Medium | 4.3 | 2026-09-09 | Tanium addressed an information disclosure vulnerability in Tanium Server. |
CVE-2026-87658 | Medium | 4.3 | 2026-09-09 | Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain cross-origin data via… |
CVE-2026-87593 | Medium | 6.5 | 2026-09-09 | Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromiu… |
CVE-2026-87574 | Medium | 4.3 | 2026-09-09 | Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-87565 | Medium | 6.5 | 2026-09-09 | Information leak in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML… |
CVE-2026-87545 | Medium | 6.5 | 2026-09-09 | Information leak in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak sensitive informat… |
CVE-2026-87541 | Medium | 6.5 | 2026-09-09 | Information leak in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolat… |
CVE-2026-87531 | Low | 3.1 | 2026-09-09 | Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data… |
CVE-2026-87521 | Low | 3.1 | 2026-09-09 | Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin da… |
CVE-2026-87495 | Medium | 4.3 | 2026-09-09 | Information leak in Scroll in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to leak cross-origin data… |
CVE-2026-87490 | Medium | 6.5 | 2026-09-09 | Information leak in Transactions Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML… |
CVE-2026-87477 | Medium | 6.5 | 2026-09-09 | Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium sec… |
CVE-2026-87461 | Medium | 4.3 | 2026-09-09 | Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted Chrome extension. (Chromium… |
CVE-2026-87454 | Medium | 6.5 | 2026-09-09 | Information leak in Enterprise in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HT… |
CVE-2026-87451 | Low | 3.1 | 2026-09-09 | Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin… |
CVE-2026-87439 | Medium | 5.3 | 2026-09-09 | Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensitiv… |
CVE-2026-87437 | Medium | 6.5 | 2026-09-09 | Information leak in Frames in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium s… |
CVE-2026-87435 | Medium | 5.3 | 2026-09-09 | Information leak in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensit… |
CVE-2026-86464 | | 2026-09-08 | In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included inse… | |
CVE-2026-86672 | Medium | 5.3 | 2026-09-08 | A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the f… |
CVE-2026-69862 | Medium | 5.5 | 2026-09-08 | Out-of-bounds read in Windows Wireless Wide Area Network Service allows an authorized attacker to disclose information locally. |
CVE-2026-69806 | High | 7.0 | 2026-09-08 | Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally. |
CVE-2026-69805 | High | 7.5 | 2026-09-08 | External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-69549 | High | 7.0 | 2026-09-08 | Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-68852 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally. |