CWE-200 · Information Disclosure (page 6)
Page 6 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54553 | Medium | 5.4 | 2026-08-26 | Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API do… |
CVE-2026-78146 | Medium | 6.5 | 2026-08-26 | The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering tha… |
CVE-2026-77758 | Medium | 5.3 | 2026-08-26 | The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation s… |
CVE-2026-77754 | Medium | 5.3 | 2026-08-26 | The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated use… |
CVE-2026-80194 | Medium | 4.3 | 2026-08-26 | Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization gu… |
CVE-2026-62865 | | 2026-08-25 | Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of lo… | |
CVE-2026-79293 | Medium | 6.5 | 2026-08-25 | Information leak in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chrom… |
CVE-2026-79291 | Medium | 6.5 | 2026-08-25 | Information leak in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium se… |
CVE-2026-79274 | Medium | 4.3 | 2026-08-25 | Information leak in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium securi… |
CVE-2026-79271 | Medium | 6.5 | 2026-08-25 | Information leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a c… |
CVE-2026-79252 | Medium | 4.3 | 2026-08-25 | Information leak in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-79246 | Medium | 6.5 | 2026-08-25 | Information leak in DataTransfer in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Ch… |
CVE-2026-79220 | Medium | 5.3 | 2026-08-25 | Information leak in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive info… |
CVE-2026-79207 | Medium | 6.5 | 2026-08-25 | Information leak in Passwords in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a crafted file. (C… |
CVE-2026-79193 | Medium | 4.3 | 2026-08-25 | Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-79185 | Medium | 4.3 | 2026-08-25 | Information leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium securi… |
CVE-2026-79147 | Medium | 5.3 | 2026-08-25 | Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain sensi… |
CVE-2026-79146 | Medium | 5.5 | 2026-08-25 | Information leak in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed ap… |
CVE-2026-79144 | Medium | 4.3 | 2026-08-25 | Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-79125 | Medium | 6.5 | 2026-08-25 | Information leak in XR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium sec… |
CVE-2026-79124 | Medium | 6.5 | 2026-08-25 | Information leak in Intents in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML pa… |
CVE-2026-79122 | Medium | 5.9 | 2026-08-25 | Information leak in SignIn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chro… |
CVE-2026-79095 | Medium | 4.3 | 2026-08-25 | Information leak in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium s… |
CVE-2026-79075 | Medium | 6.5 | 2026-08-25 | Information leak in Geolocation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information… |
CVE-2026-79074 | Medium | 5.3 | 2026-08-25 | Information leak in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive info… |
CVE-2026-79059 | Low | 3.1 | 2026-08-25 | Information leak in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain cross-origin d… |
CVE-2026-79055 | Medium | 5.1 | 2026-08-25 | Information leak in Sharing in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to obtain sensitive in… |
CVE-2026-79034 | Low | 3.1 | 2026-08-25 | Information leak in CORS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data v… |
CVE-2026-79024 | Medium | 6.5 | 2026-08-25 | Information leak in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (C… |
CVE-2026-79018 | Medium | 6.5 | 2026-08-25 | Information leak in FoldableAPIs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Ch… |
CVE-2026-79001 | Medium | 5.3 | 2026-08-25 | Information leak in Bluetooth in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leverage… |
CVE-2026-78987 | Medium | 4.3 | 2026-08-25 | Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium sec… |
CVE-2026-78981 | Medium | 6.5 | 2026-08-25 | Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to potentially obtain sensitive information via a local p… |
CVE-2026-78960 | Medium | 6.5 | 2026-08-25 | Information leak in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data via… |
CVE-2026-78957 | Medium | 5.5 | 2026-08-25 | Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a crafted file. (Chro… |
CVE-2026-78941 | Low | 3.1 | 2026-08-25 | Information leak in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation vi… |
CVE-2026-78908 | Medium | 4.3 | 2026-08-25 | Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium sec… |
CVE-2026-78896 | Medium | 4.3 | 2026-08-25 | Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-78895 | Medium | 4.3 | 2026-08-25 | Information leak in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium secu… |
CVE-2026-78893 | Medium | 6.5 | 2026-08-25 | Information leak in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium sec… |
CVE-2026-62986 | Medium | 4.3 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through… |
CVE-2026-55553 | High | 7.5 | 2026-08-25 | urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows r… |
CVE-2026-79780 | Medium | 5.3 | 2026-08-25 | rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved acro… |
CVE-2026-79776 | Medium | 5.3 | 2026-08-25 | rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can a… |
CVE-2026-79660 | Medium | 5.3 | 2026-08-25 | Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Un… |
CVE-2026-21758 | Low | 3.7 | 2026-08-25 | HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment. |
CVE-2026-72698 | Medium | 6.5 | 2026-08-25 | Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive confi… |
CVE-2026-78555 | | 2026-08-24 | RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shorte… | |
CVE-2026-75099 | Medium | 5.3 | 2026-08-24 | Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upg… |
CVE-2026-13343 | Medium | 5.3 | 2026-08-24 | The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_en… |
CVE-2026-78386 | | 2026-08-24 | RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware g… | |
CVE-2026-78378 | | 2026-08-24 | Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into… | |
CVE-2026-59256 | High | 7.5 | 2026-08-22 | WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose… |
CVE-2026-56380 | Medium | 5.3 | 2026-08-22 | AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner… |
CVE-2026-16612 | Medium | 5.3 | 2026-08-22 | The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unau… |
CVE-2026-48050 | | 2026-08-21 | Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.U… | |
CVE-2026-47735 | | 2026-08-21 | Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`)… | |
CVE-2026-34948 | High | 7.7 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQ… |
CVE-2026-53497 | Medium | 5.3 | 2026-08-21 | CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessi… |
CVE-2026-69225 | Medium | 5.9 | 2026-08-21 | There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated atta… |
CVE-2026-69224 | Medium | 5.9 | 2026-08-21 | There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow… |
CVE-2026-62316 | High | 8.8 | 2026-08-21 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py bi… |
CVE-2026-62960 | High | 7.4 | 2026-08-21 | Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remo… |
CVE-2026-30866 | High | 7.5 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has bee… |
CVE-2026-27463 | Medium | 5.3 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop versi… |
CVE-2026-71862 | High | 7.5 | 2026-08-21 | Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful… |
CVE-2026-65613 | Medium | 4.3 | 2026-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This iss… |
CVE-2026-61397 | High | 7.5 | 2026-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. Thi… |
CVE-2026-59780 | High | 7.5 | 2026-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers. … |
CVE-2026-59655 | High | 7.5 | 2026-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers. Thi… |
CVE-2026-50222 | High | 7.5 | 2026-08-21 | Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userda… |
CVE-2026-19435 | Low | 2.7 | 2026-08-21 | The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to rea… |
CVE-2026-16575 | Medium | 5.3 | 2026-08-21 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configurat… |
CVE-2026-67448 | Medium | 6.5 | 2026-08-20 | Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for t… |
CVE-2026-50192 | | 2026-08-20 | Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials… | |
CVE-2026-17060 | High | 8.1 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to a kernel heap… |
CVE-2026-16973 | Medium | 5.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to disclose sensitive kernel memory due to an out-of-bounds read. |
CVE-2026-16964 | Medium | 6.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to intercept messages and forge replies due to the exposure of sensitive informatio… |
CVE-2026-73137 | High | 7.7 | 2026-08-20 | A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permission… |
CVE-2026-52021 | High | 7.5 | 2026-08-20 | An issue in code100xDevs 100xdevs CMS v.1.0 (2026-04-30) allows a remote attacker to obtain sensitive information via the src/middleware.ts, and src/app/api/mo… |
CVE-2026-53586 | Medium | 6.5 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-21784 | Medium | 4.8 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and reso… |
CVE-2026-76390 | Medium | 5.3 | 2026-08-19 | In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through S… |
CVE-2026-76366 | Medium | 6.5 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer (REST) API filtering on playbook runs to… |
CVE-2026-76262 | High | 7.5 | 2026-08-19 | In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, in… |
CVE-2026-76256 | Medium | 4.3 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does no… |
CVE-2026-76647 | High | 8.8 | 2026-08-19 | Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php… |
CVE-2026-55088 | Medium | 6.8 | 2026-08-19 | Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an a… |
CVE-2026-61842 | Medium | 6.5 | 2026-08-19 | Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and pe… |
CVE-2026-53452 | Medium | 5.3 | 2026-08-19 | Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthent… |
CVE-2026-76206 | Medium | 5.3 | 2026-08-19 | phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. At… |
CVE-2026-75918 | High | 8.8 | 2026-08-19 | phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the… |
CVE-2026-19782 | Medium | 5.4 | 2026-08-19 | The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscr… |
CVE-2026-19406 | Low | 2.7 | 2026-08-19 | The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting… |
CVE-2026-18778 | Medium | 5.3 | 2026-08-19 | The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve… |
CVE-2026-18231 | Medium | 5.3 | 2026-08-19 | The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database r… |
CVE-2026-53959 | Medium | 6.5 | 2026-08-18 | 4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to enumerate account information for ever… |
CVE-2026-76041 | Medium | 4.3 | 2026-08-18 | Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (C… |
CVE-2026-73884 | High | 7.5 | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Eas… |
CVE-2026-73883 | High | 7.5 | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Ea… |