# CWE-202. Every Advisory and CVE whose sources give the weakness CWE-202, newest first. ## Records, newest first - [Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259](https://agentprime.io/advisories/CVE-2026-118544.md) `CVE-2026-118544` · CVE record: Drupal Commerce Core · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-202 - [PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking](https://agentprime.io/advisories/CVE-2026-110183.md) `CVE-2026-110183` · CVE record: DALIBO PostgreSQL Anonymizer · CVSS 4.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-202 - [PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats](https://agentprime.io/advisories/CVE-2026-105615.md) `CVE-2026-105615` · CVE record: DALIBO PostgreSQL Anonymizer · CVSS 3.5 Low · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-202 - [Information disclosure vulnerability in the cloud-client daemon of Deco BE63](https://agentprime.io/advisories/CVE-2026-100420.md) `CVE-2026-100420` · CVE record: TP-Link Systems Inc. Deco BE63 V2.0 · CVSS 6.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-202 - [Apache Answer: Missing Authorization Allows Mutations of Non-Public Content](https://agentprime.io/advisories/CVE-2026-79633.md) `CVE-2026-79633` · CVE record: Apache Software Foundation Apache Answer · CVSS 8.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-202 - [Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata](https://agentprime.io/advisories/CVE-2026-79620.md) `CVE-2026-79620` · CVE record: Apache Software Foundation Apache Answer · CVSS 4.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-202 - [Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles](https://agentprime.io/advisories/CVE-2026-79613.md) `CVE-2026-79613` · CVE record: Apache Software Foundation Apache Answer · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-202 - [Backstage has improper input validation in scaffolder task list ordering](https://agentprime.io/advisories/GHSA-vwp5-f99x-x3rq.md) `GHSA-vwp5-f99x-x3rq`, `CVE-2026-106506` · npm `@backstage/plugin-scaffolder-backend`: affected `<4.1.0`, fixed in `4.1.0` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, CWE-202 - [pagetriagelist discloses suppressed reviewer usernames](https://agentprime.io/advisories/CVE-2026-103440.md) `CVE-2026-103440` · CVE record: The Wikimedia Foundation MediaWiki PageTriage extension · CVSS 1.2 Low · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-202 - [Synology DiskStation Manager (DSM): An exposure of sensitive information through data queries vulnerability in Desktop API in…](https://agentprime.io/advisories/CVE-2026-40533.md) `CVE-2026-40533` · CVE record: Synology DiskStation Manager (DSM) · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-202 - [Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist](https://agentprime.io/advisories/CVE-2026-77883.md) `CVE-2026-77883` · CVE record: Apache Software Foundation Apache Syncope · CVSS 4.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-202 - [Improper input validation in Genians Genian NAC V4.0 and others](https://agentprime.io/advisories/CVE-2026-16520.md) `CVE-2026-16520` · CVE record: Genians Genian NAC V4.0 and 2 more · CVSS 8.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-20, CWE-202 - [Potential information leakage from manager /network/graph API in NeuVector](https://agentprime.io/advisories/CVE-2026-25703.md) `CVE-2026-25703` · CVE record: SUSE NeuVector · CVSS 7.3 High · Not analysed yet · Published 5 Aug 2026 · Tags: Authentication bypass, CWE-202, CWE-524 - [Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history](https://agentprime.io/advisories/GHSA-fr6g-7cq8-fg82.md) `GHSA-fr6g-7cq8-fg82`, `CVE-2026-70473` · npm `flowise`: affected `<3.1.3`, fixed in `3.1.3` · CVSS 8.3 High · Not analysed yet · Published 4 Aug 2026 · Tags: Information disclosure, Broken access control, CWE-202 - [Apache Syncope Vulnerable to Exposure of Sensitive Information Through Data Queries](https://agentprime.io/advisories/GHSA-vr35-jm2f-8wg2.md) `GHSA-vr35-jm2f-8wg2`, `CVE-2026-42797` · Maven `org.apache.syncope.core:syncope-core-provisioning-api`: affected `>=3.0.0-M0, <=3.0.16 || >=4.0.0-M0, <4.0.6 || >=4.1.0-M0, <4.1.1`, fixed in `4.0.6`, `4.1.1` · CVSS 4.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: CWE-202 - [SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information](https://agentprime.io/advisories/GHSA-27h3-crw2-q36w.md) `GHSA-27h3-crw2-q36w`, `CVE-2026-30778` · Maven `org.apache.skywalking:server-core`: affected `>=9.7.0, <10.4.0`, fixed in `10.4.0` · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-202 - [free5gc UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication](https://agentprime.io/advisories/GHSA-wrwh-rpq4-87hf.md) `GHSA-wrwh-rpq4-87hf`, `CVE-2026-40245`, `GO-2026-5722` · Go `github.com/free5gc/udr`: affected `<=1.4.2`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 14 Apr 2026 · Tags: Information disclosure, CWE-202 - [InvenTree Vulnerable to ORM Filter Injection](https://agentprime.io/advisories/CVE-2026-33530.md) `CVE-2026-33530` · CVE record: inventree InvenTree · CVSS 7.7 High · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-202 - [e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action](https://agentprime.io/advisories/CVE-2026-3546.md) `CVE-2026-3546` · CVE record: forfront e-shot · CVSS 5.3 Medium · Not analysed yet · Published 21 Mar 2026 · Tags: CWE-202 - [Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy](https://agentprime.io/advisories/GHSA-6f65-4fv2-wwch.md) `GHSA-6f65-4fv2-wwch`, `CVE-2026-25050` · npm `@vendure/core`: affected `<3.5.3`, fixed in `3.5.3` · CVSS 2.7 Low · Not analysed yet · Published 30 Jan 2026 · Tags: CWE-202 - [AIOHTTP vulnerable to brute-force leak of internal static file path components](https://agentprime.io/advisories/GHSA-54jq-c3m8-4m76.md) `GHSA-54jq-c3m8-4m76`, `CVE-2025-69226`, `PYSEC-2026-1097` · PyPI `aiohttp`: affected `<3.13.3`, fixed in `3.13.3` · CVSS 6.3 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Path traversal, Information disclosure, CWE-202 - [Unauthenticated Craft CMS users can trigger a database backup](https://agentprime.io/advisories/GHSA-v64r-7wg9-23pr.md) `GHSA-v64r-7wg9-23pr`, `CVE-2025-68456`, `PKSA-17hr-tk5g-ht8k` · Packagist `craftcms/cms`: affected `>=3.0.0, <4.16.17 || >=5.0.0-RC1, <5.8.21`, fixed in `4.16.17`, `5.8.21` · CVSS 7.0 High · Not analysed yet · Published 5 Jan 2026 · Tags: Denial of service, CWE-202 - [Users are able to find users by name even when \`enable_names\` is off](https://agentprime.io/advisories/CVE-2025-64528.md) `CVE-2025-64528` · CVE record: discourse discourse · CVSS 6.3 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: CWE-202 - [phpMyFAQ has unauthenticated config backup download via /api/setup/backup](https://agentprime.io/advisories/GHSA-9cg9-4h4f-j6fg.md) `GHSA-9cg9-4h4f-j6fg`, `CVE-2025-69200`, `PKSA-w8m6-73n2-zbk6` · Packagist `thorsten/phpmyfaq`: affected `<4.0.16 || >=4.1.0-alpha, <=4.1.0-beta.2`, fixed in `4.0.16` · CVSS 7.5 High · Not analysed yet · Published 30 Dec 2025 · Tags: CWE-202 - [Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIs](https://agentprime.io/advisories/CVE-2025-64504.md) `CVE-2025-64504` · CVE record: langfuse langfuse · CVSS 5.0 Medium · Not analysed yet · Published 10 Nov 2025 · Tags: CWE-202 - [DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly](https://agentprime.io/advisories/GHSA-79hx-3fp8-hj66.md) `GHSA-79hx-3fp8-hj66`, `CVE-2025-59352`, `GO-2025-3971` · Go `d7y.io/dragonfly/v2` and 1 more: affected `<2.1.0`, fixed in `2.1.0` · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2025 · Tags: Path traversal, CWE-202 - [Possible ORM Leak Vulnerability in the Harbor](https://agentprime.io/advisories/GHSA-h27m-3qw8-3pw8.md) `GHSA-h27m-3qw8-3pw8`, `CVE-2025-30086`, `GO-2025-3826` · Go `github.com/goharbor/harbor`: affected `<2.4.0-rc1.0.20250331071157-dce7d9f5cffb || >=2.4.0-rc1.1, <2.12.4 || >=2.13.0, <2.13.1`, fixed in `2.4.0-rc1.0.20250331071157-dce7d9f5cffb`, `2.12.4`, `2.13.1` · CVSS 4.9 Medium · Not analysed yet · Published 23 Jul 2025 · Tags: Information disclosure, CWE-202 - [Dell Wyse Management Suite: Dell Wyse Management Suite, versions prior to WMS 5.2…](https://agentprime.io/advisories/CVE-2025-36575.md) `CVE-2025-36575` · CVE record: Dell Wyse Management Suite · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2025 · Tags: CWE-202 - [Dell Wyse Management Suite: Dell Wyse Management Suite, versions prior to WMS 5.1…](https://agentprime.io/advisories/CVE-2025-29981.md) `CVE-2025-29981` · CVE record: Dell Wyse Management Suite · CVSS 7.5 High · Not analysed yet · Published 2 Apr 2025 · Tags: CWE-202 - [Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching](https://agentprime.io/advisories/CVE-2025-25205.md) `CVE-2025-25205` · CVE record: advplyr audiobookshelf · CVSS 8.2 High · Not analysed yet · Published 12 Feb 2025 · Tags: Authentication bypass, Denial of service, CWE-202 - [RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019](https://agentprime.io/advisories/CVE-2024-13255.md) `CVE-2024-13255` · CVE record: Drupal RESTful Web Services · CVSS 7.5 High · Not analysed yet · Published 9 Jan 2025 · Tags: CWE-202 - [Cisco Firepower Management Center: A vulnerability in the password change feature of Cisco Firepower Management Center (FMC)…](https://agentprime.io/advisories/CVE-2024-20388.md) `CVE-2024-20388` · CVE record: Cisco Cisco Firepower Management Center and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2024 · Tags: CWE-202 - [Cleartext Storage of Username and Password in Finrota's Netahsilat](https://agentprime.io/advisories/CVE-2024-6400.md) `CVE-2024-6400` · CVE record: Finrota Netahsilat · CVSS 8.2 High · Not analysed yet · Published 4 Oct 2024 · Tags: Information disclosure, CWE-202 - [Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi](https://agentprime.io/advisories/CVE-2024-1287.md) `CVE-2024-1287` · CVE record: Unknown pmpro-member-directory · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2024 · Tags: CWE-202 - [WAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information.](https://agentprime.io/advisories/CVE-2024-38897.md) `CVE-2024-38897` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 24 Jun 2024 · Tags: CWE-202 - [WAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information.](https://agentprime.io/advisories/CVE-2024-38895.md) `CVE-2024-38895` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 24 Jun 2024 · Tags: CWE-202 - [An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component.](https://agentprime.io/advisories/CVE-2024-38892.md) `CVE-2024-38892` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 24 Jun 2024 · Tags: CWE-202 - [NextScripts: Social Networks Auto-Poster <= 4.4.3 - Authenticated(Subscriber+) Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2024-2088.md) `CVE-2024-2088` · CVE record: nextscripts NextScripts: Social Networks Auto-Poster · CVSS 8.5 High · Not analysed yet · Published 22 May 2024 · Tags: CWE-202 - [Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API Endpoint](https://agentprime.io/advisories/CVE-2023-7072.md) `CVE-2023-7072` · CVE record: pickplugins Post Grid · CVSS 7.5 High · Not analysed yet · Published 12 Mar 2024 · Tags: CWE-202 - [OpenStack Heat information leak vulnerability](https://agentprime.io/advisories/GHSA-5836-grcc-8j89.md) `GHSA-5836-grcc-8j89`, `CVE-2023-1625`, `PYSEC-2026-1751` · PyPI `openstack-heat`: affected `<20.0.0`, fixed in `20.0.0` · CVSS 7.4 High · Not analysed yet · Published 24 Sept 2023 · Tags: Information disclosure, CWE-202 - [Cisco Secure Web Appliance: A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web…](https://agentprime.io/advisories/CVE-2023-20215.md) `CVE-2023-20215` · CVE record: Cisco Cisco Secure Web Appliance · CVSS 5.8 Medium · Not analysed yet · Published 3 Aug 2023 · Tags: CWE-202 - [SourceCodester Best Online News Portal check_availability.php information exposure](https://agentprime.io/advisories/CVE-2023-0785.md) `CVE-2023-0785` · CVE record: SourceCodester Best Online News Portal · CVSS 3.7 Low · Not analysed yet · Published 12 Feb 2023 · Tags: CWE-202 - [WordPress ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2022-41623.md) `CVE-2022-41623` · CVE record: Villatheme ALD - AliExpress Dropshipping and Fulfillment for WooCommerce (WordPress plugin) · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2022 · Tags: CWE-202 - [Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family SNMP Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2022-20810.md) `CVE-2022-20810` · CVE record: Cisco Cisco IOS XE Software · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2022 · Tags: CWE-202 - [kernel: A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data…](https://agentprime.io/advisories/CVE-2021-4159.md) `CVE-2021-4159` · CVE record: kernel · No CVSS score · Not analysed yet · Published 24 Aug 2022 · Tags: CWE-202 - [Cisco SD-WAN vManage Software Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2022-20747.md) `CVE-2022-20747` · CVE record: Cisco Cisco SD-WAN vManage · CVSS 6.5 Medium · Not analysed yet · Published 15 Apr 2022 · Tags: CWE-202 - [Cisco DNA Center Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2021-34782.md) `CVE-2021-34782` · CVE record: Cisco Cisco Digital Network Architecture Center (DNA Center) · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2021 · Tags: CWE-202 - [Passwords used to access external services inadvertently exposed through API](https://agentprime.io/advisories/CVE-2021-32743.md) `CVE-2021-32743` · CVE record: Icinga icinga2 · CVSS 8.8 High · Not analysed yet · Published 15 Jul 2021 · Tags: CWE-202 - [Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2021-1372.md) `CVE-2021-1372` · CVE record: Cisco Cisco Webex Productivity Tools · CVSS 5.5 Medium · Not analysed yet · Published 17 Feb 2021 · Tags: CWE-202 - [eSOMS Cachecontrol (Pragma) HTTP Header](https://agentprime.io/advisories/CVE-2019-19000.md) `CVE-2019-19000` · CVE record: ABB eSOMS · CVSS 6.5 Medium · Not analysed yet · Published 2 Apr 2020 · Tags: CWE-16, CWE-202 - [ABB eSOMS: HTTP response information leakage](https://agentprime.io/advisories/CVE-2019-19091.md) `CVE-2019-19091` · CVE record: ABB eSOMS · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2020 · Tags: CWE-16, CWE-202 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .