CWE-200 · Information Disclosure (page 7)
Page 7 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73878 | High | 7.5 | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Ea… |
CVE-2026-71087 | Medium | 5.3 | 2026-08-18 | Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. E… |
CVE-2026-71085 | Medium | 4.9 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25… |
CVE-2026-70990 | Medium | 6.8 | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). T… |
CVE-2026-70975 | Medium | 6.5 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25… |
CVE-2026-70974 | Medium | 5.3 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25… |
CVE-2026-70943 | High | 8.1 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25… |
CVE-2026-70942 | High | 7.7 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25… |
CVE-2026-70917 | Medium | 4.0 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25… |
CVE-2026-70916 | Medium | 4.0 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25… |
CVE-2026-70911 | Medium | 5.3 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25… |
CVE-2026-62988 | Critical | 9.0 | 2026-08-18 | Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and… |
CVE-2026-60969 | High | 7.7 | 2026-08-18 | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 a… |
CVE-2026-60853 | Low | 3.7 | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.19. Di… |
CVE-2026-60589 | Low | 3.7 | 2026-08-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2026-60415 | High | 8.1 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-60414 | High | 7.8 | 2026-08-18 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is… |
CVE-2026-60413 | High | 7.8 | 2026-08-18 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is… |
CVE-2026-60393 | High | 7.5 | 2026-08-18 | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management). The supported version that is af… |
CVE-2026-52481 | High | 7.5 | 2026-08-18 | An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the tcp_actions() function |
CVE-2026-63640 | Medium | 4.3 | 2026-08-18 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_he… |
CVE-2026-75915 | High | 7.5 | 2026-08-18 | CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment… |
CVE-2026-62684 | Low | 2.7 | 2026-08-18 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the… |
CVE-2026-69189 | High | 7.6 | 2026-08-18 | Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLS… |
CVE-2026-74986 | Critical | 9.1 | 2026-08-18 | Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunder… |
CVE-2026-74972 | Medium | 4.3 | 2026-08-18 | Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbir… |
CVE-2026-74971 | Medium | 4.3 | 2026-08-18 | Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Th… |
CVE-2026-74948 | Medium | 6.5 | 2026-08-18 | Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thund… |
CVE-2026-74945 | Medium | 6.5 | 2026-08-18 | Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1… |
CVE-2026-74934 | High | 7.5 | 2026-08-18 | Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 1… |
CVE-2026-75839 | Medium | 4.3 | 2026-08-18 | ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints… |
CVE-2026-75587 | Low | 3.6 | 2026-08-17 | Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with acces… |
CVE-2026-42164 | Critical | 9.8 | 2026-08-17 | Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the ba… |
CVE-2026-71424 | Critical | 9.6 | 2026-08-17 | Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints exp… |
CVE-2026-64778 | Medium | 6.5 | 2026-08-17 | The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 2… |
CVE-2026-64760 | Medium | 5.5 | 2026-08-17 | An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate… |
CVE-2026-57485 | High | 8.5 | 2026-08-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in… |
CVE-2026-68520 | Medium | 5.3 | 2026-08-17 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes pub… |
CVE-2026-64859 | Critical | 9.1 | 2026-08-17 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user look… |
CVE-2026-49307 | Medium | 6.2 | 2026-08-17 | Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-49302 | Medium | 6.2 | 2026-08-17 | Permission control vulnerability in the notification service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-49301 | Medium | 6.2 | 2026-08-17 | Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-19992 | Low | 3.1 | 2026-08-17 | A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the… |
CVE-2026-19717 | High | 7.5 | 2026-08-16 | The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unau… |
CVE-2026-19613 | Medium | 6.5 | 2026-08-16 | The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field value… |
CVE-2026-73055 | Medium | 4.8 | 2026-08-15 | Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explici… |
CVE-2026-73047 | Medium | 6.2 | 2026-08-15 | siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduce… |
CVE-2026-16611 | High | 7.5 | 2026-08-15 | The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowi… |
CVE-2026-16541 | Medium | 6.5 | 2026-08-15 | The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the reque… |
CVE-2026-66272 | Medium | 5.3 | 2026-08-14 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker… |
CVE-2026-19837 | Low | 2.7 | 2026-08-14 | A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search… |
CVE-2026-72834 | Medium | 4.3 | 2026-08-14 | filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch of resourceGetHandler reads the entire… |
CVE-2026-73304 | Medium | 4.9 | 2026-08-13 | Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by pack… |
CVE-2026-18068 | Medium | 4.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and element-count confusion. |
CVE-2026-72670 | High | 7.7 | 2026-08-13 | A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally… |
CVE-2026-58511 | Low | 2.7 | 2026-08-13 | Webhook Authorization Header Returned in Plaintext via API |
CVE-2026-58510 | Medium | 4.3 | 2026-08-13 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private |
CVE-2026-58442 | Medium | 6.5 | 2026-08-13 | Repository migration SSRF via multi-answer DNS allow-list bypass |
CVE-2026-58434 | High | 7.5 | 2026-08-13 | Private Repository Metadata Remains Accessible After Access Revocation |
CVE-2026-58432 | Medium | 5.9 | 2026-08-13 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive… |
CVE-2026-58427 | High | 7.5 | 2026-08-13 | Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 |
CVE-2026-58425 | Medium | 4.3 | 2026-08-13 | OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) |
CVE-2026-57897 | Medium | 6.5 | 2026-08-13 | Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs |
CVE-2026-55982 | Critical | 9.1 | 2026-08-13 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes |
CVE-2026-50105 | Medium | 4.3 | 2026-08-13 | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) |
CVE-2026-73622 | High | 7.5 | 2026-08-13 | GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate s… |
CVE-2026-73604 | Medium | 6.5 | 2026-08-13 | Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in pl… |
CVE-2026-59503 | Critical | 9.1 | 2026-08-13 | : Exposure of Sensitive Information to an Unauthorized Actor : Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Priority Port… |
CVE-2026-59499 | High | 8.6 | 2026-08-13 | : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions).. … |
CVE-2026-73411 | | 2026-08-12 | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : o… | |
CVE-2026-73406 | High | 7.5 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/inde… |
CVE-2026-73308 | Medium | 5.7 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing t… |
CVE-2026-72804 | High | 8.6 | 2026-08-12 | SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-leve… |
CVE-2026-18673 | | 2026-08-12 | When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interf… | |
CVE-2026-65017 | Medium | 6.5 | 2026-08-12 | Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mod… |
CVE-2026-54183 | Medium | 4.3 | 2026-08-12 | Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not des… |
CVE-2026-47234 | Medium | 4.4 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and… |
CVE-2026-19073 | Medium | 5.3 | 2026-08-12 | The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not… |
CVE-2026-18943 | Medium | 6.5 | 2026-08-12 | The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscri… |
CVE-2026-18049 | High | 7.5 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an o… |
CVE-2026-16253 | High | 7.5 | 2026-08-12 | The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unaut… |
CVE-2026-14925 | High | 7.5 | 2026-08-12 | The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated a… |
CVE-2026-13168 | Medium | 6.5 | 2026-08-12 | The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and abov… |
CVE-2026-12976 | Medium | 6.5 | 2026-08-12 | The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's… |
CVE-2026-73246 | High | 7.5 | 2026-08-11 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java… |
CVE-2026-73230 | | 2026-08-11 | Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32… | |
CVE-2026-73229 | Medium | 4.3 | 2026-08-11 | Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRende… |
CVE-2026-48771 | High | 8.2 | 2026-08-11 | ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side dat… |
CVE-2026-48767 | High | 7.6 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token… |
CVE-2026-73082 | | 2026-08-11 | Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoi… | |
CVE-2026-66301 | Medium | 6.5 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a… |
CVE-2026-65769 | Medium | 6.5 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network. |
CVE-2026-61924 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-61921 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-61918 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-59130 | Medium | 5.6 | 2026-08-11 | No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally. |
CVE-2026-54123 | Medium | 5.5 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally. |
CVE-2026-20737 | High | 7.9 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow… |
CVE-2026-48766 | High | 7.6 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys b… |
CVE-2026-72744 | Medium | 6.2 | 2026-08-11 | Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools wo… |