CWE-200 · Information Disclosure (page 6)
Page 6 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12408 | Medium | 4.3 | 2026-07-01 | The Slim SEO – A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vulnerable to Unauthorized Private Content Disclosure in all versions up to… |
CVE-2026-56318 | Medium | 5.3 | 2026-06-30 | Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validate_password_compliance endpoint that returns different error respo… |
CVE-2026-56300 | High | 7.5 | 2026-06-30 | Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and… |
CVE-2026-54673 | | 2026-06-30 | electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripp… | |
CVE-2026-14146 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-14098 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-14096 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-14062 | Medium | 5.9 | 2026-06-30 | Inappropriate implementation in Views in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2026-14049 | Medium | 5.3 | 2026-06-30 | Inappropriate implementation in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potent… |
CVE-2026-14004 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-13810 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Input in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information fr… |
CVE-2026-9836 | Low | 3.5 | 2026-06-30 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information disclosure vulnerability. |
CVE-2026-14161 | High | 7.5 | 2026-06-30 | Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific… |
CVE-2026-46406 | Medium | 6.1 | 2026-06-29 | Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/… |
CVE-2026-49984 | High | 7.7 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for… |
CVE-2026-55188 | High | 8.2 | 2026-06-26 | RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket repli… |
CVE-2026-49355 | Medium | 4.3 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.4.0, `GET /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id` discloses p… |
CVE-2026-47193 | High | 7.5 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field valu… |
CVE-2026-44736 | Medium | 6.5 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retriev… |
CVE-2026-57231 | High | 7.5 | 2026-06-26 | Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no va… |
CVE-2026-37452 | High | 7.5 | 2026-06-25 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the MSIAPService.ex… |
CVE-2026-37454 | High | 7.5 | 2026-06-25 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the 3DES-ECB encryp… |
CVE-2026-37453 | High | 7.5 | 2026-06-25 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the MSI_SERVICE_2 p… |
CVE-2026-55180 | Medium | 6.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace… |
CVE-2026-50017 | Medium | 6.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-l… |
CVE-2026-9153 | Medium | 6.5 | 2026-06-25 | Arbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to read arbitrary files via the expression parame… |
CVE-2026-52815 | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgnam… | |
CVE-2026-32315 | Medium | 5.5 | 2026-06-24 | motionEye (mEye) is an online interface for motion software, a video surveillance program with motion detection. Versions prior to 0.44.0 create the configurat… |
CVE-2026-47389 | High | 8.6 | 2026-06-24 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, Priva… |
CVE-2026-53949 | Medium | 5.3 | 2026-06-24 | Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypass… |
CVE-2026-49269 | High | 8.6 | 2026-06-24 | Apple M1 GPUs retain register file data between compute shader dispatches from different processes. A sandboxed Metal attacker app can run a GPU reader shader… |
CVE-2026-56337 | Medium | 5.3 | 2026-06-24 | Capgo before 12.128.2 contains an information disclosure vulnerability in the public.exist_app_v2 RPC function that allows unauthenticated attackers to enumera… |
CVE-2026-56244 | High | 7.1 | 2026-06-24 | Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-level security policies on the webhoo… |
CVE-2026-9612 | Medium | 5.3 | 2026-06-24 | The WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1… |
CVE-2026-9183 | Medium | 4.3 | 2026-06-24 | The 24liveblog - live blog tool plugin for WordPress is vulnerable to Exposure of Sensitive Information in versions up to, and including, 2.2. This is due to t… |
CVE-2026-47379 | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared-view password check fell back to strict-equality (===) comparison for… | |
CVE-2026-54317 | High | 7.6 | 2026-06-23 | Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTT… |
CVE-2026-54316 | Critical | 9.1 | 2026-06-23 | Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch too… |
CVE-2026-55450 | Critical | 9.3 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the serve… |
CVE-2026-55447 | Critical | 9.6 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attack… |
CVE-2026-54305 | Critical | 9.9 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by the Dynamic Credentials feature accepted… |
CVE-2026-54304 | High | 7.7 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows… |
CVE-2026-50019 | Medium | 6.1 | 2026-06-23 | yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked… |
CVE-2026-27604 | | 2026-06-23 | FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the A… | |
CVE-2026-56322 | High | 7.5 | 2026-06-23 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updates endpoint that resolves the defaultChannel parameter befo… |
CVE-2026-53923 | High | 7.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensions in vLLM's GGUF de… |
CVE-2026-56323 | High | 7.5 | 2026-06-22 | Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_self endpoint that allows unauthenticated attackers to enum… |
CVE-2026-54276 | Medium | 6.1 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after… |
CVE-2026-53571 | High | 7.5 | 2026-06-22 | Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be retur… |
CVE-2026-50184 | Medium | 6.1 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2… |
CVE-2026-50169 | Medium | 6.1 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2… |
CVE-2026-49356 | Low | 3.2 | 2026-06-22 | Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingU… |
CVE-2026-54264 | Medium | 6.1 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, a… |
CVE-2026-7167 | | 2026-06-22 | The vulnerability arises when the system fails to properly validate the 'email' field during the authentication process, allowing unverified or fake email addr… | |
CVE-2026-7166 | | 2026-06-22 | Vulnerability involving the exposure of sensitive data provided without adequate protection. The API exposes email and phone number data from the ‘email’ and ‘… | |
CVE-2026-56242 | High | 7.5 | 2026-06-21 | Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning user_id for supplied API keys… |
CVE-2026-56282 | Medium | 5.3 | 2026-06-20 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that exposes internal PostgreSQL replicatio… |
CVE-2026-56267 | | 2026-06-20 | Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects includ… | |
CVE-2026-56235 | Medium | 5.3 | 2026-06-20 | Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metrics, get_global_metrics, get_total_metri… |
CVE-2026-56218 | Medium | 5.3 | 2026-06-20 | Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download… |
CVE-2026-56214 | High | 7.5 | 2026-06-20 | Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org and is_paying_org that allows unauthent… |
CVE-2026-56079 | Medium | 6.5 | 2026-06-19 | Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other te… |
CVE-2026-49336 | | 2026-06-19 | @microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-preview.97 through 1.0.0-preview.101, `@mic… | |
CVE-2026-49288 | Medium | 4.3 | 2026-06-19 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and… |
CVE-2026-12620 | Medium | 6.5 | 2026-06-19 | The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1… |
CVE-2026-47633 | High | 7.5 | 2026-06-18 | Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthorized attacker to disclose information o… |
CVE-2026-12111 | Medium | 4.3 | 2026-06-18 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.4.01. This is due to… |
CVE-2026-12120 | Medium | 5.3 | 2026-06-18 | The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in… |
CVE-2026-11357 | Medium | 4.3 | 2026-06-18 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… |
CVE-2026-50200 | High | 7.5 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint pr… |
CVE-2026-47340 | Medium | 6.5 | 2026-06-17 | Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue… |
CVE-2026-46977 | Low | 3.2 | 2026-06-17 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easil… |
CVE-2026-46912 | Critical | 9.3 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). Supported versions that are affected are 9… |
CVE-2026-46910 | Critical | 9.1 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are… |
CVE-2026-46874 | Low | 3.2 | 2026-06-17 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.8. Easily exploit… |
CVE-2026-46816 | Low | 3.2 | 2026-06-17 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easil… |
CVE-2026-46815 | Low | 3.2 | 2026-06-17 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easil… |
CVE-2026-46790 | Medium | 5.3 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1… |
CVE-2026-12117 | Medium | 4.3 | 2026-06-16 | Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login… |
CVE-2026-12320 | Medium | 4.3 | 2026-06-16 | Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12311 | Medium | 4.7 | 2026-06-16 | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderb… |
CVE-2026-50870 | High | 7.5 | 2026-06-15 | An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1.2.3 allows attackers to obtain sensitive information via a… |
CVE-2026-39007 | High | 7.5 | 2026-06-15 | An issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitive information via the CSV Log export component. |
CVE-2026-8385 | Medium | 5.3 | 2026-06-15 | The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allow… |
CVE-2026-12203 | Medium | 5.3 | 2026-06-15 | A vulnerability was found in HKUDS AI-Trader up to 74caf996f78dcc0c657df8365c8544678a16e215. This affects an unknown part of the file /api/research/agents.csv… |
CVE-2026-49397 | Medium | 5.3 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to before version 2.0.14, private services (… |
CVE-2026-47124 | Medium | 6.5 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.9, any authenticated n… |
CVE-2026-54396 | | 2026-06-12 | An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user… | |
CVE-2026-47264 | Medium | 5.3 | 2026-06-12 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to b… |
CVE-2026-47263 | Medium | 4.3 | 2026-06-12 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to b… |
CVE-2026-45085 | Medium | 5.3 | 2026-06-12 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to b… |
CVE-2026-44786 | High | 7.5 | 2026-06-12 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to b… |
CVE-2026-44785 | Medium | 4.3 | 2026-06-12 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to b… |
CVE-2026-44784 | Medium | 6.5 | 2026-06-12 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to b… |
CVE-2026-44782 | Medium | 4.3 | 2026-06-12 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to b… |
CVE-2026-44780 | Medium | 4.3 | 2026-06-12 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to b… |
CVE-2026-44779 | Medium | 4.3 | 2026-06-12 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to b… |
CVE-2026-53725 | | 2026-06-12 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.5, app… | |
CVE-2026-6046 | Medium | 5.3 | 2026-06-12 | Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to validate that a username returned during bot registrat… |
CVE-2026-3433 | Medium | 4.3 | 2026-06-12 | Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to me… |