Advisories · Weakness
CWE-202.
Every Advisory and CVE whose sources give the weakness CWE-202, newest first.
-
Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259
- Drupal Commerce Core
- CWE-202
- CVSS 4.3 Medium
PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking
- DALIBO PostgreSQL Anonymizer
- CWE-202
- CVSS 3.5 Low
PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats
- DALIBO PostgreSQL Anonymizer
- CWE-202
- CVSS 6.8 Medium
Information disclosure vulnerability in the cloud-client daemon of Deco BE63
- TP-Link Systems Inc. Deco BE63 V2.0
- CWE-202
- CVSS 8.1 High
Apache Answer: Missing Authorization Allows Mutations of Non-Public Content
- Apache Software Foundation Apache Answer
- CWE-202
- CVSS 4.3 Medium
Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
- Apache Software Foundation Apache Answer
- CWE-202
- CVSS 5.3 Medium
Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles
- Apache Software Foundation Apache Answer
- CWE-202
- CVSS 5.3 Medium
Backstage has improper input validation in scaffolder task list ordering
- Information disclosure
- CWE-202
<4.1.0 · fixed in 4.1.0
GHSA-vwp5-f99x-x3rq · CVE-2026-106506 - CVSS 1.2 Low
pagetriagelist discloses suppressed reviewer usernames
- The Wikimedia Foundation MediaWiki PageTriage extension
- CWE-202
- CVSS 5.3 Medium
Synology DiskStation Manager (DSM): An exposure of sensitive information through data queries vulnerability in Desktop API in…
- Synology DiskStation Manager (DSM)
- CWE-202
- CVSS 4.9 Medium
Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist
- Apache Software Foundation Apache Syncope
- CWE-202
- CVSS 8.7 High
Improper input validation in Genians Genian NAC V4.0 and others
- Genians Genian NAC V4.0
- Genians Genian NAC V5.0
- CWE-20
- CWE-202
- CVSS 7.3 High
Potential information leakage from manager /network/graph API in NeuVector
- SUSE NeuVector
- Authentication bypass
- CWE-202
- CVSS 8.3 High
Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
- Information disclosure
- Broken access control
<3.1.3 · fixed in 3.1.3
GHSA-fr6g-7cq8-fg82 · CVE-2026-70473 - CVSS 4.9 Medium
Apache Syncope Vulnerable to Exposure of Sensitive Information Through Data Queries
- CWE-202
>=3.0.0-M0, <=3.0.16 || >=4.0.0-M0, <4.0.6 || >=4.1.0-M0, <4.1.1 · fixed in 4.0.6, 4.1.1
GHSA-vr35-jm2f-8wg2 · CVE-2026-42797 - CVSS 7.5 High
SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information
- CWE-202
>=9.7.0, <10.4.0 · fixed in 10.4.0
GHSA-27h3-crw2-q36w · CVE-2026-30778 - CVSS 7.5 High
free5gc UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication
- Information disclosure
- CWE-202
<=1.4.2 · no fixed version yet
GHSA-wrwh-rpq4-87hf · CVE-2026-40245 - CVSS 7.7 High
InvenTree Vulnerable to ORM Filter Injection
- InvenTree
- CWE-202
- CVSS 5.3 Medium
e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action
- forfront e-shot
- CWE-202
- CVSS 2.7 Low
Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy
- CWE-202
<3.5.3 · fixed in 3.5.3
GHSA-6f65-4fv2-wwch · CVE-2026-25050 - CVSS 6.3 Medium
AIOHTTP vulnerable to brute-force leak of internal static file path components
- Path traversal
- Information disclosure
<3.13.3 · fixed in 3.13.3
GHSA-54jq-c3m8-4m76 · CVE-2025-69226 - CVSS 7.0 High
Unauthenticated Craft CMS users can trigger a database backup
- Denial of service
- CWE-202
>=3.0.0, <4.16.17 || >=5.0.0-RC1, <5.8.21 · fixed in 4.16.17, 5.8.21
GHSA-v64r-7wg9-23pr · CVE-2025-68456 - CVSS 6.3 Medium
Users are able to find users by name even when `enable_names` is off
- discourse
- CWE-202
- CVSS 7.5 High
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
- CWE-202
<4.0.16 || >=4.1.0-alpha, <=4.1.0-beta.2 · fixed in 4.0.16
GHSA-9cg9-4h4f-j6fg · CVE-2025-69200 - CVSS 5.0 Medium
Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIs
- langfuse
- CWE-202
- CVSS 6.9 Medium
DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly
- Path traversal
- CWE-202
<2.1.0 · fixed in 2.1.0
GHSA-79hx-3fp8-hj66 · CVE-2025-59352 - CVSS 4.9 Medium
Possible ORM Leak Vulnerability in the Harbor
- Information disclosure
- CWE-202
<2.4.0-rc1.0.20250331071157-dce7d9f5cffb || >=2.4.0-rc1.1, <2.12.4 || >=2.13.0, <2.13.1 · fixed in 2.4.0-rc1.0.20250331071157-dce7d9f5cffb, 2.12.4, 2.13.1
GHSA-h27m-3qw8-3pw8 · CVE-2025-30086 - CVSS 7.5 High
Dell Wyse Management Suite: Dell Wyse Management Suite, versions prior to WMS 5.2…
- Dell Wyse Management Suite
- CWE-202
- CVSS 7.5 High
Dell Wyse Management Suite: Dell Wyse Management Suite, versions prior to WMS 5.1…
- Dell Wyse Management Suite
- CWE-202
- CVSS 8.2 High
Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching
- advplyr audiobookshelf
- Authentication bypass
- Denial of service
- CVSS 7.5 High
RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019
- Drupal RESTful Web Services
- CWE-202
- CVSS 5.3 Medium
Cisco Firepower Management Center: A vulnerability in the password change feature of Cisco Firepower Management Center (FMC)…
- Cisco Firepower Management Center
- Cisco Firepower Threat Defense Software
- CWE-202
- CVSS 8.2 High
Cleartext Storage of Username and Password in Finrota's Netahsilat
- Finrota Netahsilat
- Information disclosure
- CWE-202
- CVSS 6.5 Medium
Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi
- pmpro-member-directory
- CWE-202
- CVSS 5.3 Medium
WAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information.
- CWE-202
- CVSS 5.3 Medium
WAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information.
- CWE-202
- CVSS 6.5 Medium
An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component.
- CWE-202
- CVSS 8.5 High
NextScripts: Social Networks Auto-Poster <= 4.4.3 - Authenticated(Subscriber+) Sensitive Information Exposure
- NextScripts: Social Networks Auto-Poster
- CWE-202
- CVSS 7.5 High
Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API Endpoint
- pickplugins Post Grid
- CWE-202
- CVSS 7.4 High
OpenStack Heat information leak vulnerability
- Information disclosure
- CWE-202
<20.0.0 · fixed in 20.0.0
GHSA-5836-grcc-8j89 · CVE-2023-1625 - CVSS 5.8 Medium
Cisco Secure Web Appliance: A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web…
- Cisco Secure Web Appliance
- CWE-202
- CVSS 3.7 Low
SourceCodester Best Online News Portal check_availability.php information exposure
- SourceCodester Best Online News Portal
- CWE-202
- CVSS 7.5 High
WordPress ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 - Sensitive Data Exposure vulnerability
- Villatheme ALD - AliExpress Dropshipping and Fulfillment for WooCommerce (WordPress plugin)
- CWE-202
- CVSS 6.5 Medium
Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family SNMP Information Disclosure Vulnerability
- Cisco IOS XE Software
- CWE-202
-
kernel: A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data…
- kernel
- CWE-202
- CVSS 6.5 Medium
Cisco SD-WAN vManage Software Information Disclosure Vulnerability
- Cisco SD-WAN vManage
- CWE-202
- CVSS 4.3 Medium
Cisco DNA Center Information Disclosure Vulnerability
- Cisco Digital Network Architecture Center (DNA Center)
- CWE-202
- CVSS 8.8 High
Passwords used to access external services inadvertently exposed through API
- icinga2
- CWE-202
- CVSS 5.5 Medium
Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure Vulnerability
- Cisco Webex Productivity Tools
- CWE-202
- CVSS 6.5 Medium
eSOMS Cachecontrol (Pragma) HTTP Header
- ABB eSOMS
- CWE-16
- CWE-202
- CVSS 4.3 Medium
ABB eSOMS: HTTP response information leakage
- ABB eSOMS
- CWE-16
- CWE-202