CWE-200 · Information Disclosure (page 5)
Page 5 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81531 | | 2026-09-08 | An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible aft… | |
CVE-2026-0860 | High | 7.5 | 2026-09-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driv… |
CVE-2026-77132 | | 2026-09-08 | It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, lo… | |
CVE-2026-86519 | Medium | 5.3 | 2026-09-08 | A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /card_activation.sql of the component Backu… |
CVE-2026-86308 | Medium | 5.3 | 2026-09-07 | A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknow… |
CVE-2026-86441 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-rela… |
CVE-2026-86419 | Critical | 9.1 | 2026-09-07 | Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In f… |
CVE-2026-86418 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by… |
CVE-2026-86417 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetched User.email, whi… |
CVE-2026-86302 | Medium | 5.3 | 2026-09-07 | A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /HIS/his.sql… |
CVE-2026-86284 | Medium | 5.3 | 2026-09-07 | A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnera… |
CVE-2026-86217 | Medium | 5.3 | 2026-09-06 | A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hotel_db%20(1).sql of t… |
CVE-2026-86179 | Medium | 5.3 | 2026-09-06 | A flaw has been found in code-projects Daily Expense Manager 1.0. Affected is an unknown function of the file /Daily-Expense-Manager/exp_ak.sql of the componen… |
CVE-2026-86190 | Critical | 9.1 | 2026-09-05 | WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery t… |
CVE-2026-84926 | Low | 2.7 | 2026-09-05 | The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authe… |
CVE-2026-84745 | Low | 2.7 | 2026-09-05 | The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowin… |
CVE-2026-81348 | Low | 3.7 | 2026-09-05 | The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing… |
CVE-2026-78149 | Medium | 5.3 | 2026-09-05 | The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through… |
CVE-2026-19858 | High | 7.5 | 2026-09-05 | The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data duri… |
CVE-2026-71626 | High | 7.5 | 2026-09-04 | An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and Webh… |
CVE-2026-84933 | Medium | 6.5 | 2026-09-04 | undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In… |
CVE-2026-18486 | High | 8.8 | 2026-09-04 | IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges du… |
CVE-2026-75163 | Medium | 6.5 | 2026-09-04 | An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 returns detailed… |
CVE-2026-75162 | Medium | 6.5 | 2026-09-04 | An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any… |
CVE-2026-19300 | High | 7.5 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields. |
CVE-2026-18887 | Medium | 6.5 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information in PASE. An attacker could exploit this vulnerability to acc… |
CVE-2026-85517 | Medium | 5.3 | 2026-09-04 | A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unknown function of the file /vehicle_management.sql of the co… |
CVE-2026-85588 | | 2026-09-04 | phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extra… | |
CVE-2026-84146 | Medium | 5.3 | 2026-09-04 | The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce… |
CVE-2026-81270 | High | 7.5 | 2026-09-04 | Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to versi… |
CVE-2026-79631 | Medium | 5.3 | 2026-09-04 | The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory… |
CVE-2026-17517 | Medium | 5.3 | 2026-09-04 | The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthen… |
CVE-2026-44506 | High | 8.2 | 2026-09-03 | Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could retu… |
CVE-2026-50554 | Medium | 5.3 | 2026-09-03 | Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "dele… |
CVE-2026-85157 | Medium | 5.3 | 2026-09-03 | WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a prog… |
CVE-2026-85156 | Medium | 5.3 | 2026-09-03 | WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted vide… |
CVE-2026-84658 | Medium | 4.3 | 2026-09-02 | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configur… |
CVE-2026-81199 | Medium | 5.3 | 2026-09-02 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics… |
CVE-2026-81197 | Medium | 5.3 | 2026-09-02 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filte… |
CVE-2026-81195 | Medium | 5.3 | 2026-09-02 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and… |
CVE-2026-78151 | Medium | 5.3 | 2026-09-02 | The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its… |
CVE-2026-77782 | Medium | 5.3 | 2026-09-02 | The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated S… |
CVE-2026-19251 | Medium | 5.3 | 2026-09-02 | The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before… |
CVE-2026-16983 | Medium | 4.3 | 2026-09-02 | The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of pa… |
CVE-2026-16966 | Medium | 5.3 | 2026-09-02 | The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated vi… |
CVE-2026-84359 | Low | 3.1 | 2026-09-02 | Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data v… |
CVE-2026-84348 | Medium | 6.5 | 2026-09-02 | Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information via a crafted HTML… |
CVE-2026-84481 | | 2026-09-01 | WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configur… | |
CVE-2026-73775 | High | 7.7 | 2026-09-01 | Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exp… |
CVE-2026-73745 | Low | 3.1 | 2026-09-01 | A vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some information handled by the af… |
CVE-2026-73739 | Medium | 4.4 | 2026-09-01 | A vulnerability exists in the API of HPE Networking Fabric Composer that allows for an attacker with administrative privileges to access sensitive information… |
CVE-2026-73738 | Medium | 4.7 | 2026-09-01 | A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access… |
CVE-2026-73732 | Medium | 5.6 | 2026-09-01 | A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access… |
CVE-2026-84143 | Critical | 9.8 | 2026-09-01 | Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or… |
CVE-2026-84142 | Critical | 9.8 | 2026-09-01 | Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume th… |
CVE-2026-84136 | Medium | 6.1 | 2026-09-01 | Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
CVE-2026-84135 | Critical | 9.8 | 2026-09-01 | Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155. |
CVE-2026-84134 | Critical | 9.8 | 2026-09-01 | Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
CVE-2026-84132 | High | 7.5 | 2026-09-01 | Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153… |
CVE-2026-84130 | High | 7.5 | 2026-09-01 | Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153… |
CVE-2026-84127 | Medium | 4.3 | 2026-09-01 | Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155. |
CVE-2026-53682 | Medium | 5.3 | 2026-09-01 | An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating int… |
CVE-2026-84195 | High | 7.7 | 2026-09-01 | Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit… |
CVE-2026-13611 | Medium | 5.3 | 2026-09-01 | The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose… |
CVE-2026-53553 | High | 7.7 | 2026-08-31 | Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, spec… |
CVE-2026-53507 | | 2026-08-31 | oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff ac… | |
CVE-2026-82810 | Low | 3.3 | 2026-08-31 | A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExte… |
CVE-2026-82809 | Medium | 4.3 | 2026-08-31 | A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of th… |
CVE-2026-82624 | Medium | 5.3 | 2026-08-31 | A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of… |
CVE-2026-81322 | | 2026-08-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash r… | |
CVE-2026-82657 | High | 7.5 | 2026-08-30 | Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can… |
CVE-2026-82651 | Medium | 4.9 | 2026-08-30 | SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in ke… |
CVE-2026-82548 | Medium | 5.3 | 2026-08-30 | A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This man… |
CVE-2026-77007 | High | 7.5 | 2026-08-29 | The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, a… |
CVE-2026-82306 | Medium | 6.5 | 2026-08-28 | StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Aut… |
CVE-2026-55485 | High | 8.8 | 2026-08-28 | Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superus… |
CVE-2026-81732 | | 2026-08-28 | WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to u… | |
CVE-2026-42393 | Low | 3.1 | 2026-08-28 | The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access t… |
CVE-2026-42392 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response return… |
CVE-2026-40203 | Low | 3.7 | 2026-08-28 | When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail a… |
CVE-2026-14567 | Medium | 5.3 | 2026-08-28 | The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retriev… |
CVE-2026-78174 | | 2026-08-28 | WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retr… | |
CVE-2026-61802 | Medium | 6.5 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low… |
CVE-2026-61783 | Medium | 6.5 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an au… |
CVE-2026-77438 | High | 7.5 | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the… |
CVE-2026-59288 | High | 7.4 | 2026-08-27 | The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the… |
CVE-2026-37069 | Medium | 5.3 | 2026-08-27 | Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthentica… |
CVE-2026-81679 | High | 7.7 | 2026-08-27 | OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administ… |
CVE-2026-81101 | Medium | 6.5 | 2026-08-27 | The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given… |
CVE-2026-26897 | Critical | 9.8 | 2026-08-27 | An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbit… |
CVE-2026-78138 | Medium | 4.3 | 2026-08-27 | The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbi… |
CVE-2026-78125 | Medium | 5.3 | 2026-08-27 | The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2… |
CVE-2026-77017 | High | 7.7 | 2026-08-27 | The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed d… |
CVE-2026-19715 | High | 7.5 | 2026-08-27 | The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and… |
CVE-2026-77507 | Medium | 5.3 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do… |
CVE-2026-62249 | Medium | 4.3 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to… |
CVE-2026-46371 | Medium | 6.5 | 2026-08-26 | Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint (GET /api/… |
CVE-2026-46370 | Medium | 6.5 | 2026-08-26 | Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint (GET /api/v1/flee… |
CVE-2026-48786 | Medium | 6.5 | 2026-08-26 | Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) r… |
CVE-2025-61164 | High | 7.5 | 2026-08-26 | Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint. |