CWE-209 · Generation of Error Message Containing Sensitive Information (page 2)
Page 2 of 7 — CVEs classified under CWE-209, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-1262 | Medium | 4.3 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information disclosure vulnerability. |
CVE-2026-21783 | Medium | 4.3 | 2026-03-24 | HCL Traveler is affected by sensitive information disclosure. The application generates some error messages that provide detailed information about errors and… |
CVE-2026-4633 | Low | 3.7 | 2026-03-23 | A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. Th… |
CVE-2026-33192 | Medium | 5.3 | 2026-03-20 | Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a dow… |
CVE-2026-33065 | Medium | 5.3 | 2026-03-20 | Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a dow… |
CVE-2025-13726 | Medium | 5.3 | 2026-03-13 | IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information when… |
CVE-2026-30835 | Medium | 5.3 | 2026-03-06 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.7 and 9.5.0-alpha.6, malformed $… |
CVE-2026-29110 | Low | 2.2 | 2026-03-06 | Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.0, in non-debug mode Cryptomator might leak cleartext paths into the log… |
CVE-2026-2752 | Medium | 5.3 | 2026-03-06 | Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send crafted requests to trigger an unhandle… |
CVE-2026-28675 | Medium | 5.3 | 2026-03-06 | OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, some endpoints returned r… |
CVE-2026-22052 | Medium | 4.3 | 2026-03-05 | ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticate… |
CVE-2026-27643 | Medium | 5.3 | 2026-02-24 | free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and includ… |
CVE-2025-69253 | Medium | 5.3 | 2026-02-24 | free5GC is an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 of the User Data Repository are affected by… |
CVE-2025-69208 | Medium | 5.3 | 2026-02-23 | free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Versions prior to 1.4.1 cont… |
CVE-2025-65995 | Medium | 6.5 | 2026-02-21 | When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitiv… |
CVE-2026-27004 | Medium | 5.5 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in some shared-agent deployments, OpenClaw session tools (`sessions_list`, `sessions_history`… |
CVE-2025-36348 | Medium | 4.9 | 2026-02-17 | IBM Sterling B2B Integrator versions 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 through 6.2.1.1, and IBM Sterling File Gateway versions 6… |
CVE-2026-23598 | Medium | 6.5 | 2026-02-17 | Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive inf… |
CVE-2025-66594 | Medium | 5.3 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Detailed messages are displayed on the error page. This information co… |
CVE-2023-38281 | Medium | 5.3 | 2026-02-04 | IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a… |
CVE-2023-38017 | Medium | 5.3 | 2026-02-04 | IBM Cloud Pak System is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the… |
CVE-2023-38010 | Medium | 5.3 | 2026-02-04 | IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the system. |
CVE-2025-12773 | Medium | 6.5 | 2026-02-03 | A vulnerability in update-reports-purge-settings.sh script logging for Brocade SANnav before 2.4.0a could allow the collection of SANnav database password in t… |
CVE-2026-22778 | Critical | 9.8 | 2026-02-02 | vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpo… |
CVE-2025-1395 | High | 8.2 | 2026-01-30 | Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc. HeyGarson allows Fuzzing for a… |
CVE-2025-11065 | Medium | 5.3 | 2026-01-26 | A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information… |
CVE-2025-52023 | Medium | 5.3 | 2026-01-23 | A vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that dis… |
CVE-2025-52022 | Medium | 5.3 | 2026-01-23 | A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that… |
CVE-2026-24130 | Medium | 5.3 | 2026-01-22 | Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the "ldap" compon… |
CVE-2026-1175 | Medium | 5.3 | 2026-01-19 | A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql of the component GraphQL Directive Han… |
CVE-2025-55250 | Low | 1.8 | 2026-01-19 | HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information… |
CVE-2025-15526 | Medium | 5.3 | 2026-01-16 | The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.8. This is due to improper erro… |
CVE-2026-22646 | Medium | 4.3 | 2026-01-15 | Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable re… |
CVE-2026-20838 | Medium | 5.5 | 2026-01-13 | Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-62840 | Low | 3.3 | 2026-01-02 | A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local n… |
CVE-2022-50686 | High | 7.5 | 2025-12-18 | An information disclosure vulnerability in Kentico Xperience allows attackers to view sensitive stack trace details via Portal Engine form control error messag… |
CVE-2025-68110 | Critical | 9.9 | 2025-12-17 | ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, use… |
CVE-2025-9122 | Medium | 5.3 | 2025-12-15 | Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full s… |
CVE-2025-13978 | Medium | 4.3 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allow… |
CVE-2025-36437 | Medium | 4.3 | 2025-12-09 | IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system. |
CVE-2025-66549 | Low | 2.4 | 2025-12-05 | Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the… |
CVE-2025-13596 | | 2025-11-24 | A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When cer… | |
CVE-2025-52671 | Medium | 4.3 | 2025-11-20 | Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information… |
CVE-2025-41076 | Medium | 6.5 | 2025-11-20 | In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a ge… |
CVE-2025-9977 | | 2025-11-18 | Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthent… | |
CVE-2025-54562 | Medium | 4.3 | 2025-11-14 | A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Technical Information to be Disclosed t… |
CVE-2025-64749 | Medium | 4.3 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API… |
CVE-2025-40760 | Medium | 5.5 | 2025-11-11 | A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messages and discloses sen… |
CVE-2025-61959 | Medium | 5.3 | 2025-10-29 | Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framew… |
CVE-2025-12365 | Medium | 5.3 | 2025-10-27 | Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-62397 | Medium | 5.3 | 2025-10-23 | The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance. |
CVE-2025-62168 | Critical | 10.0 | 2025-10-17 | Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information… |
CVE-2025-55676 | Medium | 5.5 | 2025-10-14 | Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose information locally. |
CVE-2025-31998 | Low | 3.5 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this inform… |
CVE-2025-54291 | Medium | 5.3 | 2025-10-02 | Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project exist… |
CVE-2025-26333 | Medium | 5.9 | 2025-09-25 | Dell BSAFE Crypto-J generates an error message that includes sensitive information about its environment and associated data. A remote attacker could potential… |
CVE-2025-53803 | Medium | 5.5 | 2025-09-09 | Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-43776 | Medium | 5.4 | 2025-09-09 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025… |
CVE-2025-59016 | Medium | 4.3 | 2025-09-09 | Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.3… |
CVE-2025-43777 | Medium | 5.3 | 2025-09-09 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 thro… |
CVE-2025-48562 | Medium | 5.0 | 2025-09-04 | In writeContent of RemotePrintDocument.java, there is a possible information disclosure due to a logic error. This could lead to local information disclosure w… |
CVE-2025-22421 | Medium | 5.5 | 2025-09-02 | In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due to a logic error i… |
CVE-2025-36003 | High | 7.5 | 2025-08-28 | IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are… |
CVE-2025-9229 | Medium | 5.3 | 2025-08-20 | Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detailed error informati… |
CVE-2025-52619 | Medium | 5.3 | 2025-08-15 | HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages disclose sensitive version… |
CVE-2025-9005 | Low | 3.7 | 2025-08-15 | A vulnerability was determined in mtons mblog up to 3.5.0. Affected is an unknown function of the file /register. The manipulation leads to information exposur… |
CVE-2025-54791 | Medium | 5.3 | 2025-08-13 | OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgo… |
CVE-2024-41984 | Low | 2.6 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41983 | Low | 3.5 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2025-8852 | Medium | 4.3 | 2025-08-11 | A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Han… |
CVE-2025-23320 | High | 7.5 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause the shared memory limit to b… |
CVE-2025-46658 | Critical | 9.8 | 2025-08-05 | An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. There are verbose error messages. |
CVE-2025-8548 | Low | 3.7 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/… |
CVE-2025-47813 | Medium | 4.3 | 2025-07-10 | loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie. |
CVE-2025-36090 | Medium | 4.3 | 2025-07-10 | IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain information about the application framework which could be used in rec… |
CVE-2024-37524 | Medium | 5.3 | 2025-07-10 | IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retur… |
CVE-2025-40718 | High | 7.5 | 2025-07-08 | Improper error handling vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to send malformed payloads… |
CVE-2025-5731 | Medium | 5.5 | 2025-06-26 | A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command… |
CVE-2025-44203 | High | 7.5 | 2025-06-20 | In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation w… |
CVE-2025-49128 | Medium | 4.0 | 2025-06-06 | Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and… |
CVE-2024-56342 | Medium | 4.3 | 2025-06-06 | IBM Verify Identity Access Digital Credentials 24.06 could allow a remote attacker to obtain sensitive information when a detailed technical error message is r… |
CVE-2025-25025 | Medium | 4.3 | 2025-05-28 | IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. T… |
CVE-2025-40653 | | 2025-05-26 | User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages could allow an att… | |
CVE-2025-41441 | Medium | 5.3 | 2025-05-26 | Mailform Pro CGI prior to 4.3.4 generates error messages containing sensitive information, which may allow a remote unauthenticated attacker to obtain coupon c… |
CVE-2025-46746 | Medium | 5.8 | 2025-05-12 | An administrator could discover another account's credentials. |
CVE-2025-4166 | Medium | 4.5 | 2025-05-02 | Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submi… |
CVE-2025-0049 | Low | 3.5 | 2025-04-28 | When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server p… |
CVE-2025-46575 | Medium | 4.9 | 2025-04-27 | There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive inform… |
CVE-2025-25045 | Medium | 4.3 | 2025-04-23 | IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. Th… |
CVE-2025-20150 | Medium | 5.3 | 2025-04-16 | A vulnerability in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to enumerate LDAP user accounts. This vulnerability is due to the i… |
CVE-2024-11129 | Medium | 6.3 | 2025-04-10 | An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers… |
CVE-2025-32238 | Medium | 4.3 | 2025-04-04 | Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-schedul… |
CVE-2025-0279 | Medium | 4.3 | 2025-04-03 | HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, c… |
CVE-2023-47639 | Medium | 5.3 | 2025-04-03 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are… |
CVE-2024-55895 | Low | 2.7 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2025-31141 | Low | 2.7 | 2025-03-27 | In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page |
CVE-2024-12380 | Medium | 4.4 | 2025-03-13 | An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions st… |
CVE-2025-2239 | Medium | 5.3 | 2025-03-12 | Generation of Error Message Containing Sensitive Information vulnerability in Hillstone Networks Hillstone Next Generation FireWall.This issue affects Hillston… |
CVE-2025-23185 | Medium | 4.1 | 2025-03-11 | Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown t… |
CVE-2025-20002 | Medium | 5.3 | 2025-03-05 | After attempting to upload a file that does not meet prerequisites, GMOD Apollo will respond with local path information disclosure |