CWE-200 · Information Disclosure (page 8)
Page 8 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6826 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated… |
CVE-2026-9129 | | 2026-05-20 | A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-pr… | |
CVE-2025-31985 | Low | 3.7 | 2026-05-20 | HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow b… |
CVE-2026-6728 | Medium | 5.3 | 2026-05-20 | The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.0.9 via the 'get_stream_data()'… |
CVE-2026-5075 | Medium | 4.3 | 2026-05-20 | The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via 'internalOptions' localized script data in versions up to, and incl… |
CVE-2026-34970 | | 2026-05-20 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow a bugnote author to access the note's Revisions page after losin… | |
CVE-2026-34744 | | 2026-05-19 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior permit a user to list and download their own attachments from an Issue… | |
CVE-2026-34600 | Medium | 5.7 | 2026-05-19 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.5.2 and prior contain a logic error in the… |
CVE-2026-34579 | | 2026-05-19 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior are vulnerable to Authorization Bypass through the private issue monit… | |
CVE-2026-32814 | Medium | 6.5 | 2026-05-19 | libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the defau… |
CVE-2026-8706 | Medium | 6.5 | 2026-05-19 | Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receiv… |
CVE-2026-8967 | High | 7.5 | 2026-05-19 | Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8966 | High | 7.5 | 2026-05-19 | Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8965 | High | 7.5 | 2026-05-19 | Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-31909 | High | 7.5 | 2026-05-19 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recomme… |
CVE-2026-44408 | Medium | 6.3 | 2026-05-19 | There is an unauthorized access vulnerability in ZTE MU5250. Due to improper permission control of the Web interface, an unauthorized attacker can modify conf… |
CVE-2026-32244 | Medium | 5.3 | 2026-05-19 | Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, outdated cached AI summaries can leak… |
CVE-2026-27892 | Medium | 6.5 | 2026-05-18 | FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploaded images byte-for-by… |
CVE-2026-39079 | High | 7.5 | 2026-05-18 | An issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitive information via the /modules/upsshipping/lo… |
CVE-2026-6347 | High | 7.6 | 2026-05-18 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin whic… |
CVE-2026-6346 | High | 8.7 | 2026-05-18 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before including them in support pa… |
CVE-2026-8766 | Medium | 4.3 | 2026-05-17 | A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the compone… |
CVE-2026-8750 | Medium | 5.3 | 2026-05-17 | A vulnerability was identified in h2oai h2o-3 up to 7402. Affected by this issue is the function importFiles of the file h2o-core/src/main/java/water/persist/P… |
CVE-2026-45351 | Medium | 6.5 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.9, when a regular user [non-admin] logs into th… |
CVE-2026-45387 | Medium | 4.3 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, when setting model permissions so that a gro… |
CVE-2026-45539 | High | 7.4 | 2026-05-15 | Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate packag… |
CVE-2026-41960 | Medium | 5.8 | 2026-05-15 | Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-27886 | High | 7.5 | 2026-05-14 | Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query paramete… |
CVE-2026-41615 | Critical | 9.6 | 2026-05-14 | Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network. |
CVE-2026-42283 | High | 7.7 | 2026-05-14 | DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from… |
CVE-2026-0245 | Medium | 5.5 | 2026-05-13 | Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configuration data and credentials. The Prism… |
CVE-2026-44479 | Medium | 5.5 | 2026-05-13 | Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode (--non-inter… |
CVE-2026-44431 | Medium | 5.3 | 2026-05-13 | urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_fro… |
CVE-2026-41954 | Medium | 4.9 | 2026-05-13 | Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated… |
CVE-2025-9987 | Medium | 5.3 | 2026-05-13 | The Broadstreet plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.53.1 via the get_sponsored_meta()… |
CVE-2026-41610 | Medium | 6.3 | 2026-05-12 | Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security… |
CVE-2026-40379 | Critical | 9.3 | 2026-05-12 | Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-40374 | Medium | 6.5 | 2026-05-12 | Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network. |
CVE-2026-43992 | Critical | 9.8 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract… |
CVE-2026-42498 | High | 7.3 | 2026-05-12 | Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: f… |
CVE-2026-45091 | Critical | 9.1 | 2026-05-12 | sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 throu… |
CVE-2026-7626 | Medium | 5.3 | 2026-05-12 | The Slek Gateway for WooCommerce plugin for WordPress is vulnerable to Information Exposure in version 1.0. This is due to the wsb_handle_slek_payment_redirect… |
CVE-2026-43885 | | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php an… | |
CVE-2026-42564 | High | 8.2 | 2026-05-11 | jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filen… |
CVE-2026-28976 | High | 7.5 | 2026-05-11 | An information leakage was addressed with additional validation. This issue is fixed in macOS Tahoe 26.5. An app may be able to gain root privileges. |
CVE-2026-28962 | High | 7.5 | 2026-05-11 | This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS T… |
CVE-2026-28958 | Medium | 5.5 | 2026-05-11 | This issue was addressed with improved data protection. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tah… |
CVE-2026-28922 | Medium | 6.5 | 2026-05-11 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be a… |
CVE-2026-28920 | Medium | 6.5 | 2026-05-11 | An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 1… |
CVE-2026-42873 | Unrated | | 2026-05-11 | WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, when attempting to upload a file with malicious content to funcionario/docdepe… |
CVE-2026-42871 | | 2026-05-11 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/familiar_docfamiliar.php displays an overly descriptive error message… | |
CVE-2026-5266 | | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files in… | |
CVE-2026-42865 | Medium | 4.3 | 2026-05-11 | Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could del… |
CVE-2026-34093 | Medium | 5.3 | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-44738 | High | 7.7 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from wi… |
CVE-2026-34092 | High | 7.5 | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-34091 | High | 7.5 | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7… |
CVE-2026-34090 | High | 7.5 | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue affects CheckUser: from 1.45.0 before 1… |
CVE-2026-34088 | High | 7.5 | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7… |
CVE-2026-34087 | High | 7.5 | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7… |
CVE-2026-42333 | | 2026-05-09 | Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17… | |
CVE-2026-8198 | Medium | 5.3 | 2026-05-09 | The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Dis… |
CVE-2026-42456 | Medium | 4.3 | 2026-05-08 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.12.1, GET /api/w… |
CVE-2026-41520 | High | 7.9 | 2026-05-08 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-… |
CVE-2026-42213 | | 2026-05-08 | SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, the inc "fil… | |
CVE-2026-42195 | Low | 3.4 | 2026-05-08 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that override… |
CVE-2026-25199 | Critical | 9.1 | 2026-05-08 | Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects Apache CloudStack: from… |
CVE-2026-43942 | Medium | 5.5 | 2026-05-08 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/a… |
CVE-2026-42880 | Critical | 9.6 | 2026-05-07 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing au… |
CVE-2026-42826 | Critical | 10.0 | 2026-05-07 | Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network. |
CVE-2026-42047 | High | 8.6 | 2026-05-07 | Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orchestration. Versions 3.22.0 through 3.53… |
CVE-2026-41659 | Low | 2.7 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hi… |
CVE-2026-8033 | Medium | 5.3 | 2026-05-06 | A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. This affects an unknown function of the file /cdemos/echs/api/v2/ of the com… |
CVE-2026-7999 | Medium | 4.3 | 2026-05-06 | Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process m… |
CVE-2026-34474 | High | 7.5 | 2026-05-06 | Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. A crafted request to the router web interface can expose sen… |
CVE-2026-8028 | Low | 3.7 | 2026-05-06 | A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.se… |
CVE-2025-52613 | Medium | 4.6 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the… |
CVE-2025-31984 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow b… |
CVE-2025-31982 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk… |
CVE-2025-31976 | Medium | 4.8 | 2026-05-06 | HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal appl… |
CVE-2025-31975 | Low | 2.6 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. Exposed server banners may reveal software ve… |
CVE-2026-8026 | Low | 3.7 | 2026-05-06 | A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/accou… |
CVE-2026-43646 | High | 7.5 | 2026-05-06 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9… |
CVE-2026-36355 | High | 7.7 | 2026-05-05 | The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the wri… |
CVE-2026-4409 | Medium | 6.5 | 2026-05-05 | The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leaked secret key and usage of a weak hash… |
CVE-2026-42223 | Medium | 6.5 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all… |
CVE-2026-42220 | Medium | 6.5 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive conf… |
CVE-2026-42151 | High | 7.5 | 2026-05-04 | Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote wri… |
CVE-2026-42092 | Medium | 6.5 | 2026-05-04 | titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role… |
CVE-2026-3504 | Medium | 5.3 | 2026-05-02 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2025-14726 | Medium | 6.5 | 2026-05-02 | The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check… |
CVE-2026-33448 | Low | 3.3 | 2026-04-30 | CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.50. Attackers with control of a modifi… |
CVE-2026-7382 | Medium | 6.5 | 2026-04-30 | Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability in MeWare Software… |
CVE-2026-7381 | Critical | 9.1 | 2026-04-29 | Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation se… |
CVE-2026-7071 | Medium | 5.3 | 2026-04-27 | A security vulnerability has been detected in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/us… |
CVE-2026-7041 | Low | 3.7 | 2026-04-26 | A vulnerability was detected in 666ghj MiroFish up to 0.1.2. The impacted element is an unknown function of the file /console of the component Werkzeug Debugge… |
CVE-2026-7021 | Low | 3.5 | 2026-04-26 | A weakness has been identified in SmythOS sre up to 0.0.15. This impacts an unknown function of the file packages/sdk/src/LLM/utils.ts of the component Connect… |
CVE-2026-41492 | Critical | 9.8 | 2026-04-24 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoi… |
CVE-2026-41079 | Medium | 4.3 | 2026-04-24 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a cr… |
CVE-2026-21515 | Critical | 9.9 | 2026-04-24 | Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a network. |