CWE-201 · Insertion of Sensitive Information into Sent Data (page 2)
Page 2 of 4 — CVEs classified under CWE-201, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39473 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in Pär Thernström Simple History simple-history allows Retrieve Embedded Sensitive Data.This is… |
CVE-2026-20151 | High | 7.3 | 2026-04-01 | A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges… |
CVE-2026-4927 | Medium | 6.5 | 2026-04-01 | Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys vi… |
CVE-2026-34226 | High | 7.5 | 2026-03-27 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current pa… |
CVE-2026-27877 | Medium | 6.5 | 2026-03-27 | When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of pro… |
CVE-2026-32538 | High | 7.5 | 2026-03-25 | Insertion of Sensitive Information Into Sent Data vulnerability in Noor Alam SMTP Mailer smtp-mailer allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2026-25339 | Medium | 6.5 | 2026-03-25 | Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.Thi… |
CVE-2026-33180 | High | 7.5 | 2026-03-20 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP r… |
CVE-2026-32829 | High | 7.5 | 2026-03-20 | lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sen… |
CVE-2026-27935 | Medium | 6.5 | 2026-03-19 | Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a vulnerability in an API endpoint that discl… |
CVE-2026-27934 | High | 7.5 | 2026-03-19 | Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checks with a user actio… |
CVE-2026-2578 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members to access unreveale… |
CVE-2025-11500 | | 2026-03-16 | Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for interface management an… | |
CVE-2026-32354 | Medium | 5.3 | 2026-03-13 | Insertion of Sensitive Information Into Sent Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2025-14483 | Medium | 4.3 | 2026-03-13 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 could di… |
CVE-2026-28481 | Medium | 6.5 | 2026-03-05 | OpenClaw versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patched in 2026.2.1, in the MS Teams attachment downloader (optional… |
CVE-2026-27406 | High | 7.5 | 2026-03-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Joe Dolson My Tickets my-tickets allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2026-27370 | High | 7.5 | 2026-03-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Premio Chaty chaty allows Retrieve Embedded Sensitive Data.This issue affects Chaty: from n/… |
CVE-2026-23546 | Medium | 6.5 | 2026-03-05 | Insertion of Sensitive Information Into Sent Data vulnerability in RadiusTheme Classified Listing classified-listing allows Retrieve Embedded Sensitive Data.Th… |
CVE-2025-68515 | Medium | 5.8 | 2026-03-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Roland Murg WP Booking System wp-booking-system allows Retrieve Embedded Sensitive Data.This… |
CVE-2026-28131 | Medium | 6.5 | 2026-02-26 | Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve E… |
CVE-2026-1694 | Medium | 4.3 | 2026-02-26 | HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebS… |
CVE-2026-27465 | Medium | 6.5 | 2026-02-26 | Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s configuration API could expose Google Calendar service… |
CVE-2026-27516 | High | 7.5 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior expose user passwords in plaintext within the administrative interface and HTTP… |
CVE-2026-27514 | Medium | 6.5 | 2026-02-23 | Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a sensitive information exposure vulnerability in the configuration download functionali… |
CVE-2025-68855 | Medium | 5.9 | 2026-02-20 | Insertion of Sensitive Information Into Sent Data vulnerability in themeglow JobBoard Job listing job-board-light allows Retrieve Embedded Sensitive Data.This… |
CVE-2026-25008 | Medium | 4.3 | 2026-02-19 | Insertion of Sensitive Information Into Sent Data vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2025-7708 | Medium | 6.8 | 2026-02-09 | Insertion of Sensitive Information Into Sent Data vulnerability in Atlas Educational Software Industry Ltd. Co. K12net allows Communication Channel Manipulatio… |
CVE-2025-15329 | Medium | 4.9 | 2026-02-05 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2020-37150 | High | 7.5 | 2026-02-05 | Edimax EW-7438RPn-v3 Mini 1.27 allows unauthenticated attackers to access the /wizard_reboot.asp page in unsetup mode, which discloses the Wi-Fi SSID and secur… |
CVE-2020-37093 | High | 7.5 | 2026-02-03 | Netis E1+ 1.2.32533 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve WiFi passwords through the netcore_get.c… |
CVE-2026-24427 | Medium | 5.5 | 2026-02-03 | Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose sensitive information in web management responses. Administrative credentials, including t… |
CVE-2026-24992 | Medium | 5.3 | 2026-02-03 | Insertion of Sensitive Information Into Sent Data vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-s… |
CVE-2025-67857 | Medium | 4.3 | 2026-02-03 | A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorize… |
CVE-2026-1539 | Medium | 5.8 | 2026-01-28 | A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirect… |
CVE-2026-24477 | High | 7.5 | 2026-01-27 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.1… |
CVE-2026-24430 | High | 7.5 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses genera… |
CVE-2026-24589 | Medium | 5.3 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in Cargus eCommerce Cargus cargus allows Retrieve Embedded Sensitive Data.This issue affects Ca… |
CVE-2026-24565 | Medium | 6.5 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in bPlugins B Accordion b-accordion allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2026-24559 | Medium | 5.3 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot allows Retrieve Embedded Sensit… |
CVE-2026-24557 | Medium | 5.3 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in WEN Solutions Contact Form 7 GetResponse Extension contact-form-7-getresponse-extension allo… |
CVE-2025-68035 | High | 7.5 | 2026-01-22 | Insertion of Sensitive Information Into Sent Data vulnerability in tabbyai Tabby Checkout tabby-checkout allows Retrieve Embedded Sensitive Data.This issue aff… |
CVE-2025-68006 | Medium | 6.5 | 2026-01-22 | Insertion of Sensitive Information Into Sent Data vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Retrieve Embedded Sensitive Data.This i… |
CVE-2025-63019 | Medium | 5.3 | 2026-01-22 | Insertion of Sensitive Information Into Sent Data vulnerability in Johan Jonk Stenström Cookies and Content Security Policy cookies-and-content-security-policy… |
CVE-2026-23878 | Medium | 6.5 | 2026-01-19 | HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ceacd5f1476458792c44c6a993670f02c984b4a0… |
CVE-2026-22246 | Medium | 6.5 | 2026-01-08 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to in… |
CVE-2025-67931 | High | 7.5 | 2026-01-08 | Insertion of Sensitive Information Into Sent Data vulnerability in AITpro BulletProof Security bulletproof-security allows Retrieve Embedded Sensitive Data.Thi… |
CVE-2026-22539 | | 2026-01-07 | As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via… | |
CVE-2025-59955 | Medium | 5.7 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 h… |
CVE-2025-68033 | High | 7.5 | 2026-01-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Brecht Custom Related Posts custom-related-posts allows Retrieve Embedded Sensitive Data.Thi… |
CVE-2025-68029 | Medium | 6.3 | 2026-01-05 | Insertion of Sensitive Information Into Sent Data vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Retrieve Embedd… |
CVE-2025-68014 | Medium | 6.5 | 2026-01-05 | Insertion of Sensitive Information Into Sent Data vulnerability in awethemes AweBooking awebooking allows Retrieve Embedded Sensitive Data.This issue affects A… |
CVE-2025-62126 | Medium | 5.3 | 2025-12-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows Retrieve Embedded Sensitive Data.T… |
CVE-2025-59136 | Medium | 5.3 | 2025-12-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial woo-gerencianet-official allows Retrieve Embedded Sensitive Dat… |
CVE-2025-62139 | Medium | 5.3 | 2025-12-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Vladimir Statsenko Terms descriptions terms-descriptions allows Retrieve Embedded Sensitive… |
CVE-2025-59003 | Medium | 5.8 | 2025-12-31 | Insertion of Sensitive Information Into Sent Data vulnerability in inkthemescom ColorWay colorway allows Retrieve Embedded Sensitive Data.This issue affects Co… |
CVE-2025-68989 | Medium | 4.3 | 2025-12-30 | Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson contact-form-7-mailchimp-extension contact-form-7-mailchimp-extension allows R… |
CVE-2025-68040 | Medium | 6.5 | 2025-12-30 | Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.Thi… |
CVE-2025-68516 | Medium | 5.0 | 2025-12-24 | Insertion of Sensitive Information Into Sent Data vulnerability in Essekia Tablesome tablesome allows Retrieve Embedded Sensitive Data.This issue affects Table… |
CVE-2025-62998 | Medium | 5.0 | 2025-12-18 | Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This iss… |
CVE-2025-14823 | Medium | 5.3 | 2025-12-18 | In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be return… |
CVE-2025-66116 | High | 7.5 | 2025-12-18 | Insertion of Sensitive Information Into Sent Data vulnerability in UserElements Ultimate Member Widgets for Elementor ultimate-member-widgets-for-elementor all… |
CVE-2025-64295 | Medium | 6.5 | 2025-12-18 | Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data… |
CVE-2025-64218 | High | 7.5 | 2025-12-18 | Insertion of Sensitive Information Into Sent Data vulnerability in WP Chill Passster content-protector allows Retrieve Embedded Sensitive Data.This issue affec… |
CVE-2025-64213 | High | 7.5 | 2025-12-18 | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Ret… |
CVE-2025-49919 | Medium | 5.8 | 2025-12-18 | Insertion of Sensitive Information Into Sent Data vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Retrieve Embedded Sensitive Data.This iss… |
CVE-2025-49918 | Medium | 5.9 | 2025-12-18 | Insertion of Sensitive Information Into Sent Data vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Retrieve Embedded Sensitive… |
CVE-2025-66126 | Medium | 5.3 | 2025-12-16 | Insertion of Sensitive Information Into Sent Data vulnerability in wowpress.host Fix Media Library wow-media-library-fix allows Retrieve Embedded Sensitive Dat… |
CVE-2025-66125 | Medium | 5.3 | 2025-12-16 | Insertion of Sensitive Information Into Sent Data vulnerability in Nitesh Ultimate Auction ultimate-auction allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2025-49300 | Low | 2.7 | 2025-12-16 | Insertion of Sensitive Information Into Sent Data vulnerability in shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.T… |
CVE-2025-66388 | Medium | 6.5 | 2025-12-15 | A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potent… |
CVE-2025-67721 | High | 7.5 | 2025-12-12 | Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of m… |
CVE-2025-63071 | Medium | 5.3 | 2025-12-09 | Insertion of Sensitive Information Into Sent Data vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded… |
CVE-2025-63007 | Medium | 4.3 | 2025-12-09 | Insertion of Sensitive Information Into Sent Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive… |
CVE-2025-62997 | Medium | 5.3 | 2025-12-09 | Insertion of Sensitive Information Into Sent Data vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Retrieve Embedded Sensitive Data.This is… |
CVE-2025-62994 | Medium | 4.3 | 2025-12-09 | Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This iss… |
CVE-2025-62109 | Medium | 5.3 | 2025-12-09 | Insertion of Sensitive Information Into Sent Data vulnerability in INFINITUM FORM Geo Controller cf-geoplugin allows Retrieve Embedded Sensitive Data.This issu… |
CVE-2025-66566 | | 2025-12-05 | yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and… | |
CVE-2025-58098 | High | 8.3 | 2025-12-05 | Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd… |
CVE-2025-13295 | High | 7.5 | 2025-12-02 | Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier. This issue affects BILGER… |
CVE-2025-20789 | Medium | 4.4 | 2025-12-02 | In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execu… |
CVE-2025-66304 | Medium | 6.2 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the passwo… |
CVE-2025-66035 | | 2025-11-26 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16… | |
CVE-2025-65944 | | 2025-11-25 | Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDe… | |
CVE-2025-64299 | Low | 2.7 | 2025-11-21 | LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes. |
CVE-2025-52639 | Low | 3.5 | 2025-11-18 | HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitle… |
CVE-2025-7000 | Medium | 4.3 | 2025-11-15 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.6 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that, under specific… |
CVE-2025-2615 | Medium | 4.3 | 2025-11-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have all… |
CVE-2025-64748 | Medium | 6.5 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to sea… |
CVE-2025-64407 | Medium | 5.3 | 2025-11-12 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would ca… |
CVE-2025-59509 | Medium | 5.5 | 2025-11-11 | Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally. |
CVE-2025-64502 | | 2025-11-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB `explain()` method provides detailed inform… | |
CVE-2025-62039 | High | 7.5 | 2025-11-06 | Insertion of Sensitive Information Into Sent Data vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Re… |
CVE-2025-62038 | Medium | 6.5 | 2025-11-06 | Insertion of Sensitive Information Into Sent Data vulnerability in Sovlix MeetingHub meetinghub allows Retrieve Embedded Sensitive Data.This issue affects Meet… |
CVE-2025-60188 | High | 7.5 | 2025-11-06 | Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This i… |
CVE-2025-55155 | Medium | 5.4 | 2025-11-04 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, th… |
CVE-2025-64351 | Medium | 4.3 | 2025-10-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Retrieve Embedded Sensitive Data.This is… |
CVE-2025-62979 | Medium | 5.3 | 2025-10-27 | Insertion of Sensitive Information Into Sent Data vulnerability in airesvsg ACF to REST API acf-to-rest-api allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2025-62947 | Medium | 5.0 | 2025-10-27 | Insertion of Sensitive Information Into Sent Data vulnerability in publitio Publitio publitio allows Retrieve Embedded Sensitive Data.This issue affects Publit… |
CVE-2025-62895 | Medium | 5.3 | 2025-10-27 | Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This i… |