CWE-201 · Insertion of Sensitive Information into Sent Data (page 2)
Page 2 of 5 — CVEs classified under CWE-201, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48965 | Medium | 6.5 | 2026-06-15 | Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions. |
CVE-2026-42667 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Bookly <= 27.4 versions. |
CVE-2026-42384 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11.2 versions. |
CVE-2026-40789 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions. |
CVE-2026-39480 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions. |
CVE-2026-49064 | High | 7.5 | 2026-06-15 | Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data. This issue affects GetPaid: from n… |
CVE-2026-7184 | Medium | 6.5 | 2026-06-12 | Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows… |
CVE-2026-44487 | High | 7.5 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization he… |
CVE-2026-44486 | High | 7.5 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redir… |
CVE-2026-46481 | High | 8.3 | 2026-06-08 | OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and re… |
CVE-2026-42539 | Medium | 6.5 | 2026-06-04 | IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive da… |
CVE-2026-45739 | Low | 3.1 | 2026-06-04 | Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the Gr… |
CVE-2026-4035 | High | 7.7 | 2026-06-03 | A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to e… |
CVE-2026-44653 | Medium | 6.5 | 2026-06-02 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, users with only `VIEW` access to an MCP serv… |
CVE-2026-35447 | | 2026-06-02 | NamelessMC is website software for Minecraft servers. In version 2.2.4, the profile page (modules/Core/pages/profile.php) processes wall post submissions and r… | |
CVE-2026-42673 | High | 7.5 | 2026-06-01 | Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from L… |
CVE-2026-49370 | Low | 3.4 | 2026-05-29 | In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests |
CVE-2026-10101 | Medium | 6.3 | 2026-05-29 | ACM/MCE assisted-service writes raw referenced pull-secret contents into `InfraEnv.status.conditions[].message` when pull-secret validation fails. A namespace… |
CVE-2026-45582 | Medium | 6.5 | 2026-05-29 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.3, the workflow telemetry sani… |
CVE-2026-42746 | High | 7.3 | 2026-05-27 | Insertion of Sensitive Information Into Sent Data vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Retrieve Embedded Sensitiv… |
CVE-2026-48877 | Medium | 6.5 | 2026-05-27 | Insertion of Sensitive Information Into Sent Data vulnerability in Tom GenerateBlocks allows Retrieve Embedded Sensitive Data. This issue affects GenerateBloc… |
CVE-2026-41181 | Medium | 5.8 | 2026-05-15 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik's err… |
CVE-2025-62309 | Low | 2.6 | 2026-05-14 | HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may allow sensitive information to be store… |
CVE-2025-62308 | Medium | 5.1 | 2026-05-14 | HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed. Exposure of such information could reveal internal syste… |
CVE-2025-62305 | Medium | 5.1 | 2026-05-14 | HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions, potentially resulting in unintended disclosure of sensit… |
CVE-2026-45215 | Medium | 5.3 | 2026-05-12 | Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2026-42880 | Critical | 9.6 | 2026-05-07 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing au… |
CVE-2025-31978 | Medium | 4.6 | 2026-05-06 | HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An… |
CVE-2026-42997 | High | 7.7 | 2026-05-05 | An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpo… |
CVE-2026-42379 | High | 7.7 | 2026-04-27 | Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data.This issue affects Templately… |
CVE-2026-42042 | Medium | 5.4 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript t… |
CVE-2026-5512 | Medium | 4.3 | 2026-04-21 | An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private rep… |
CVE-2026-40161 | High | 7.7 | 2026-04-21 | Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2… |
CVE-2026-40293 | Medium | 6.5 | 2026-04-17 | OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentic… |
CVE-2026-4525 | High | 7.5 | 2026-04-17 | If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarde… |
CVE-2025-41118 | Critical | 9.1 | 2026-04-15 | Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If th… |
CVE-2026-5483 | High | 8.5 | 2026-04-10 | A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the d… |
CVE-2026-39912 | Critical | 9.1 | 2026-04-09 | V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with… |
CVE-2026-39711 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Retrieve Embedded Sensitive Data.This… |
CVE-2026-39709 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal the-tech-tribe allows Retrieve Embedded Sensitive Data.This issue af… |
CVE-2026-39586 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This i… |
CVE-2026-39570 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive… |
CVE-2026-39564 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Retrieve Embedded Sensitive… |
CVE-2026-39542 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensi… |
CVE-2026-39473 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in Pär Thernström Simple History simple-history allows Retrieve Embedded Sensitive Data.This is… |
CVE-2026-20151 | High | 7.3 | 2026-04-01 | A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges… |
CVE-2026-4927 | Medium | 6.5 | 2026-04-01 | Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys vi… |
CVE-2026-34226 | High | 7.5 | 2026-03-27 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current pa… |
CVE-2026-27877 | Medium | 6.5 | 2026-03-27 | When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of pro… |
CVE-2026-32538 | High | 7.5 | 2026-03-25 | Insertion of Sensitive Information Into Sent Data vulnerability in Noor Alam SMTP Mailer smtp-mailer allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2026-25339 | Medium | 6.5 | 2026-03-25 | Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.Thi… |
CVE-2026-33180 | High | 7.5 | 2026-03-20 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP r… |
CVE-2026-32829 | High | 7.5 | 2026-03-20 | lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sen… |
CVE-2026-27935 | Medium | 6.5 | 2026-03-19 | Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a vulnerability in an API endpoint that discl… |
CVE-2026-27934 | High | 7.5 | 2026-03-19 | Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checks with a user actio… |
CVE-2026-2578 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members to access unreveale… |
CVE-2025-11500 | | 2026-03-16 | Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for interface management an… | |
CVE-2026-32354 | Medium | 5.3 | 2026-03-13 | Insertion of Sensitive Information Into Sent Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2025-14483 | Medium | 4.3 | 2026-03-13 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 could di… |
CVE-2026-28481 | Medium | 6.5 | 2026-03-05 | OpenClaw versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patched in 2026.2.1, in the MS Teams attachment downloader (optional… |
CVE-2026-27406 | High | 7.5 | 2026-03-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Joe Dolson My Tickets my-tickets allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2026-27370 | High | 7.5 | 2026-03-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Premio Chaty chaty allows Retrieve Embedded Sensitive Data.This issue affects Chaty: from n/… |
CVE-2026-23546 | Medium | 6.5 | 2026-03-05 | Insertion of Sensitive Information Into Sent Data vulnerability in RadiusTheme Classified Listing classified-listing allows Retrieve Embedded Sensitive Data.Th… |
CVE-2025-68515 | Medium | 5.8 | 2026-03-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Roland Murg WP Booking System wp-booking-system allows Retrieve Embedded Sensitive Data.This… |
CVE-2026-28131 | Medium | 6.5 | 2026-02-26 | Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve E… |
CVE-2026-1694 | Medium | 4.3 | 2026-02-26 | HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebS… |
CVE-2026-27465 | Medium | 6.5 | 2026-02-26 | Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s configuration API could expose Google Calendar service… |
CVE-2026-27516 | High | 7.5 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior expose user passwords in plaintext within the administrative interface and HTTP… |
CVE-2026-27514 | Medium | 6.5 | 2026-02-23 | Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a sensitive information exposure vulnerability in the configuration download functionali… |
CVE-2025-68855 | Medium | 5.9 | 2026-02-20 | Insertion of Sensitive Information Into Sent Data vulnerability in themeglow JobBoard Job listing job-board-light allows Retrieve Embedded Sensitive Data.This… |
CVE-2026-25008 | Medium | 4.3 | 2026-02-19 | Insertion of Sensitive Information Into Sent Data vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2025-7708 | Medium | 6.8 | 2026-02-09 | Insertion of Sensitive Information Into Sent Data vulnerability in Atlas Educational Software Industry Ltd. Co. K12net allows Communication Channel Manipulatio… |
CVE-2025-15329 | Medium | 4.9 | 2026-02-05 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2020-37150 | High | 7.5 | 2026-02-05 | Edimax EW-7438RPn-v3 Mini 1.27 allows unauthenticated attackers to access the /wizard_reboot.asp page in unsetup mode, which discloses the Wi-Fi SSID and secur… |
CVE-2020-37093 | High | 7.5 | 2026-02-03 | Netis E1+ 1.2.32533 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve WiFi passwords through the netcore_get.c… |
CVE-2026-24427 | Medium | 5.5 | 2026-02-03 | Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose sensitive information in web management responses. Administrative credentials, including t… |
CVE-2026-24992 | Medium | 5.3 | 2026-02-03 | Insertion of Sensitive Information Into Sent Data vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-s… |
CVE-2025-67857 | Medium | 4.3 | 2026-02-03 | A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorize… |
CVE-2026-1539 | Medium | 5.8 | 2026-01-28 | A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirect… |
CVE-2026-24477 | High | 7.5 | 2026-01-27 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.1… |
CVE-2026-24430 | High | 7.5 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses genera… |
CVE-2026-24589 | Medium | 5.3 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in Cargus eCommerce Cargus cargus allows Retrieve Embedded Sensitive Data.This issue affects Ca… |
CVE-2026-24565 | Medium | 6.5 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in bPlugins B Accordion b-accordion allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2026-24559 | Medium | 5.3 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot allows Retrieve Embedded Sensit… |
CVE-2026-24557 | Medium | 5.3 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in WEN Solutions Contact Form 7 GetResponse Extension contact-form-7-getresponse-extension allo… |
CVE-2025-68035 | High | 7.5 | 2026-01-22 | Insertion of Sensitive Information Into Sent Data vulnerability in tabbyai Tabby Checkout tabby-checkout allows Retrieve Embedded Sensitive Data.This issue aff… |
CVE-2025-68006 | Medium | 6.5 | 2026-01-22 | Insertion of Sensitive Information Into Sent Data vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Retrieve Embedded Sensitive Data.This i… |
CVE-2025-63019 | Medium | 5.3 | 2026-01-22 | Insertion of Sensitive Information Into Sent Data vulnerability in Johan Jonk Stenström Cookies and Content Security Policy cookies-and-content-security-policy… |
CVE-2026-23878 | Medium | 6.5 | 2026-01-19 | HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ceacd5f1476458792c44c6a993670f02c984b4a0… |
CVE-2026-22246 | Medium | 6.5 | 2026-01-08 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to in… |
CVE-2025-67931 | High | 7.5 | 2026-01-08 | Insertion of Sensitive Information Into Sent Data vulnerability in AITpro BulletProof Security bulletproof-security allows Retrieve Embedded Sensitive Data.Thi… |
CVE-2026-22539 | | 2026-01-07 | As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via… | |
CVE-2025-59955 | Medium | 5.7 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 h… |
CVE-2025-68033 | High | 7.5 | 2026-01-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Brecht Custom Related Posts custom-related-posts allows Retrieve Embedded Sensitive Data.Thi… |
CVE-2025-68029 | Medium | 6.3 | 2026-01-05 | Insertion of Sensitive Information Into Sent Data vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Retrieve Embedd… |
CVE-2025-68014 | Medium | 6.5 | 2026-01-05 | Insertion of Sensitive Information Into Sent Data vulnerability in awethemes AweBooking awebooking allows Retrieve Embedded Sensitive Data.This issue affects A… |
CVE-2025-62126 | Medium | 5.3 | 2025-12-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows Retrieve Embedded Sensitive Data.T… |
CVE-2025-59136 | Medium | 5.3 | 2025-12-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial woo-gerencianet-official allows Retrieve Embedded Sensitive Dat… |
CVE-2025-62139 | Medium | 5.3 | 2025-12-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Vladimir Statsenko Terms descriptions terms-descriptions allows Retrieve Embedded Sensitive… |
CVE-2025-59003 | Medium | 5.8 | 2025-12-31 | Insertion of Sensitive Information Into Sent Data vulnerability in inkthemescom ColorWay colorway allows Retrieve Embedded Sensitive Data.This issue affects Co… |