CWE-200 · Information Disclosure (page 5)
Page 5 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13230 | Medium | 6.5 | 2026-07-15 | An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocatio… |
CVE-2026-52101 | Critical | 9.1 | 2026-07-14 | An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in u… |
CVE-2026-49853 | High | 7.7 | 2026-07-14 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed onl… |
CVE-2026-48001 | Low | 3.7 | 2026-07-14 | Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on condit… |
CVE-2026-15642 | Low | 3.3 | 2026-07-14 | Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an at… |
CVE-2026-57102 | High | 8.8 | 2026-07-14 | Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-57095 | Medium | 6.2 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-56184 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-50681 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally. |
CVE-2026-50483 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information locally. |
CVE-2026-50473 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-50456 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-50442 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-50434 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally. |
CVE-2026-50431 | Medium | 5.5 | 2026-07-14 | Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability |
CVE-2026-50430 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally. |
CVE-2026-50429 | High | 8.2 | 2026-07-14 | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-50419 | Low | 3.3 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-50416 | Low | 3.3 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-50415 | Medium | 5.3 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Media allows an unauthorized attacker to disclose information over a network. |
CVE-2026-50409 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Overlay Filter allows an authorized attacker to disclose information locally. |
CVE-2026-50394 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally. |
CVE-2026-50389 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-50352 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally. |
CVE-2026-50339 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally. |
CVE-2026-50334 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Notification allows an authorized attacker to disclose information locally. |
CVE-2026-50697 | High | 7.8 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-50350 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Trusted Runtime Interface Driver allows an authorized attacker to disclose information lo… |
CVE-2026-49807 | Medium | 6.2 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally. |
CVE-2026-47282 | Medium | 6.5 | 2026-07-14 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
CVE-2026-41087 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-34349 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally. |
CVE-2026-34328 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Audio Service allows an authorized attacker to disclose information locally. |
CVE-2026-33842 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-55651 | High | 7.1 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an… |
CVE-2026-52837 | | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/… | |
CVE-2026-15075 | High | 7.5 | 2026-07-14 | In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers a… |
CVE-2026-10051 | High | 7.5 | 2026-07-14 | In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Su… |
CVE-2026-15627 | Medium | 4.3 | 2026-07-14 | A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/t… |
CVE-2026-12385 | Medium | 4.3 | 2026-07-13 | The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parame… |
CVE-2026-15530 | Medium | 5.3 | 2026-07-13 | A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=up… |
CVE-2026-56336 | Medium | 5.3 | 2026-07-12 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id a… |
CVE-2026-56259 | High | 8.2 | 2026-07-12 | Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-cont… |
CVE-2026-56238 | High | 7.5 | 2026-07-12 | Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that allows unauthenticated attackers to… |
CVE-2026-61454 | Medium | 5.3 | 2026-07-11 | The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at… |
CVE-2026-61426 | High | 8.6 | 2026-07-11 | PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated a… |
CVE-2026-56303 | High | 7.5 | 2026-07-11 | Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable b… |
CVE-2026-6801 | Medium | 5.3 | 2026-07-11 | The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_pop… |
CVE-2026-10865 | Medium | 5.3 | 2026-07-11 | The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template… |
CVE-2026-7544 | Medium | 4.3 | 2026-07-11 | The Mux Video Uploader plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the muxvideo_enqueu… |
CVE-2026-12426 | Medium | 5.3 | 2026-07-11 | The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3… |
CVE-2026-59155 | | 2026-07-10 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notificati… | |
CVE-2026-55882 | | 2026-07-10 | Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers un… | |
CVE-2026-57219 | High | 7.5 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client… |
CVE-2026-55664 | Medium | 4.3 | 2026-07-10 | Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying th… |
CVE-2026-57474 | Medium | 5.3 | 2026-07-10 | Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This infor… |
CVE-2026-59180 | Low | 3.1 | 2026-07-10 | Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, A… |
CVE-2026-55500 | Critical | 9.9 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys… |
CVE-2026-57994 | Medium | 5.3 | 2026-07-10 | phpMyFAQ before 4.1.5 applies inconsistent active=yes and publication-date filtering across its public FAQ API endpoints, allowing unauthenticated attackers to… |
CVE-2026-15329 | Medium | 4.3 | 2026-07-10 | A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue affects the function BrowserTool._do_navigate of the file agent/tools/browser/browser_to… |
CVE-2026-59828 | Medium | 5.3 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, post revisions that should be hidden from regular users c… |
CVE-2026-49256 | High | 7.5 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly r… |
CVE-2026-45788 | High | 7.5 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, secure uploads could be exposed by pull_hotlinked_images… |
CVE-2026-45780 | Medium | 5.3 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample… |
CVE-2025-63579 | High | 7.5 | 2026-07-09 | Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming dat… |
CVE-2026-59720 | High | 7.5 | 2026-07-09 | Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input f… |
CVE-2026-59222 | Medium | 6.5 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full Use… |
CVE-2026-59216 | High | 7.7 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool… |
CVE-2026-59209 | Medium | 6.5 | 2026-07-09 | n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared wor… |
CVE-2026-57481 | | 2026-07-08 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscri… | |
CVE-2026-15044 | Medium | 6.3 | 2026-07-08 | A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific security setting is not enabled, these s… |
CVE-2026-56298 | Medium | 4.3 | 2026-07-08 | Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can up… |
CVE-2026-56284 | Medium | 5.3 | 2026-07-08 | Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id)… |
CVE-2026-56226 | High | 7.5 | 2026-07-08 | Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the… |
CVE-2026-44877 | Medium | 6.5 | 2026-07-07 | An unauthenticated remote disclosure vulnerability has been identified in HPE Networking Instant On 1830, 1930, and 1960 Switches. Successful exploitation of t… |
CVE-2026-49487 | Medium | 6.5 | 2026-07-07 | In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred… |
CVE-2026-48892 | Medium | 6.5 | 2026-07-07 | The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFL… |
CVE-2026-48891 | Medium | 4.3 | 2026-07-07 | A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still e… |
CVE-2026-48828 | Medium | 6.5 | 2026-07-07 | The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which trig… |
CVE-2026-53647 | | 2026-07-07 | FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is ac… | |
CVE-2026-53643 | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized ac… | |
CVE-2026-53640 | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, low-privileged staff accounts may read sensitive data via admi… | |
CVE-2026-14898 | Medium | 6.5 | 2026-07-06 | The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in con… |
CVE-2026-55994 | High | 7.5 | 2026-07-06 | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Iggy… |
CVE-2026-55993 | High | 7.5 | 2026-07-06 | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Atmo… |
CVE-2026-46726 | High | 7.5 | 2026-07-06 | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Vert… |
CVE-2026-46584 | Low | 3.7 | 2026-07-06 | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer (M… |
CVE-2026-58419 | High | 7.5 | 2026-07-03 | Notification API leaks private issue metadata after access revocation |
CVE-2026-56646 | Medium | 6.5 | 2026-07-03 | Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a networ… |
CVE-2026-25038 | High | 7.5 | 2026-07-03 | Gitea 1.26.2 allows unauthorized users to access labels of private organizations. |
CVE-2026-24451 | High | 7.5 | 2026-07-03 | Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be… |
CVE-2026-14611 | Medium | 4.3 | 2026-07-03 | A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function initProjectMemory of the file src/managers/MemoryManager.ts… |
CVE-2026-10055 | High | 8.5 | 2026-07-03 | In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /… |
CVE-2026-55792 | | 2026-07-02 | Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl(… | |
CVE-2026-53467 | Medium | 5.3 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contai… |
CVE-2026-58036 | High | 7.5 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-58033 | Medium | 6.5 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-58027 | Medium | 6.5 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program f… |
CVE-2026-58026 | Medium | 5.7 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-58024 | Medium | 5.7 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |