# CWE-212.

Every Advisory and CVE whose sources give the weakness CWE-212, newest first.

## Records, newest first

- [CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig](https://agentprime.io/advisories/CVE-2026-118996.md)
  `CVE-2026-118996` · CVE record · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-212
- [Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs](https://agentprime.io/advisories/GHSA-c8m5-c952-6cm4.md)
  `GHSA-c8m5-c952-6cm4`, `RUSTSEC-2026-0346` · crates.io `rustls`: affected `<0.23.46 || >=0.24.0-dev.1, <0.24.0-dev.2`, fixed in `0.23.46`, `0.24.0-dev.2` · CVSS 4.0 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-212
- [OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration](https://agentprime.io/advisories/CVE-2026-115363.md)
  `CVE-2026-115363` · CVE record: openbao openbao · CVSS 2.1 Low · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-212
- [follow-redirects array-form headers bypass cross-origin credential stripping](https://agentprime.io/advisories/GHSA-q3jh-wrc6-jgq8.md)
  `GHSA-q3jh-wrc6-jgq8`, `CVE-2026-111756` · npm `follow-redirects`: affected `>=1.16.0, <1.16.1`, fixed in `1.16.1` · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure, CWE-212
- [Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint](https://agentprime.io/advisories/CVE-2026-111387.md)
  `CVE-2026-111387` · CVE record: nezhahq nezha · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-212
- [Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when \`include_content=False\`](https://agentprime.io/advisories/GHSA-3gh4-cghq-f8v4.md)
  `GHSA-3gh4-cghq-f8v4`, `CVE-2026-107293`, `PYSEC-2026-4274`, `PYSEC-2026-4283` · PyPI `pydantic-ai` and 1 more: affected `>=0.3.4, <1.107.4 || >=2.0.0b1, <2.27.1`, fixed in `1.107.4`, `2.27.1` · CVSS 2.3 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, CWE-212
- [Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when \`include_content=False\`](https://agentprime.io/advisories/GHSA-4x9p-g9wm-8q7f.md)
  `GHSA-4x9p-g9wm-8q7f`, `CVE-2026-107291`, `PYSEC-2026-4275`, `PYSEC-2026-4284` · PyPI `pydantic-ai` and 1 more: affected `>=0.3.4, <1.107.6 || >=2.0.0b1, <2.44.0`, fixed in `1.107.6`, `2.44.0` · CVSS 2.3 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, CWE-212
- ["Checked by" label in page history should not be shown if the underlying review log entry is suppressed"](https://agentprime.io/advisories/CVE-2026-96879.md)
  `CVE-2026-96879` · CVE record: The Wikimedia Foundation Mediawiki - FlaggedRevs extension · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-212
- [This Power System update is being released to address](https://agentprime.io/advisories/CVE-2026-17511.md)
  `CVE-2026-17511` · CVE record: IBM PowerVM Hypervisor · CVSS 3.4 Low · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-212
- [Canva: The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned…](https://agentprime.io/advisories/CVE-2026-90860.md)
  `CVE-2026-90860` · CVE record: Canva Canva · CVSS 7.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-212
- [HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or Transfer](https://agentprime.io/advisories/CVE-2026-67071.md)
  `CVE-2026-67071` · CVE record: HCLSoftware HCL DevOps Deploy / HCL Launch · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-212
- [Security Advisory 0178](https://agentprime.io/advisories/CVE-2026-73440.md)
  `CVE-2026-73440` · CVE record: Arista Networks EOS · CVSS 2.3 Low · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-212
- [Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains](https://agentprime.io/advisories/CVE-2026-86740.md)
  `CVE-2026-86740` · CVE record: grokability snipe-it · CVSS 5.1 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-212
- [Microsoft Security Advisory CVE-2026-62900 – .NET Information Disclosure Vulnerability](https://agentprime.io/advisories/GHSA-23fw-v26w-5fgq.md)
  `GHSA-23fw-v26w-5fgq`, `BIT-dotnet-2026-62900`, `BIT-dotnet-sdk-2026-62900`, `CVE-2026-62900` · NuGet `Microsoft.Build.Tasks.Git` and 1 more: affected `>=10.0.102, <10.0.111 || >=10.0.200, <=10.0.204 || >=10.0.300, <10.0.303`, fixed in `10.0.111`, `10.0.303` · CVSS 5.9 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-212
- [Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router](https://agentprime.io/advisories/CVE-2026-82069.md)
  `CVE-2026-82069` · CVE record: MongoDB MongoDB Server · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-212
- [IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerability](https://agentprime.io/advisories/CVE-2026-78658.md)
  `CVE-2026-78658` · CVE record: IBM UCD - IBM UrbanCode Deploy and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-212
- [Canva: The Canva Android App before 2.376.0 did not restrict the headers returned to an external…](https://agentprime.io/advisories/CVE-2026-85094.md)
  `CVE-2026-85094` · CVE record: Canva Canva · CVSS 8.8 High · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-212
- [AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd](https://agentprime.io/advisories/CVE-2024-5300.md)
  `CVE-2024-5300` · CVE record: Canonical Ubuntu 26.04 LTS and 4 more · CVSS 5.6 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-212
- [Kronosnet: kronosnet: encryption key exposure in memory after cryptographic configuration changes](https://agentprime.io/advisories/CVE-2026-15811.md)
  `CVE-2026-15811` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 5.8 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-212
- [Guzzle: URI fragments disclosed in redirect Referer headers](https://agentprime.io/advisories/GHSA-h95v-h523-3mw8.md)
  `GHSA-h95v-h523-3mw8`, `CVE-2026-67354`, `PKSA-fy2t-3c5f-827y` · Packagist `guzzlehttp/guzzle`: affected `<7.15.1`, fixed in `7.15.1` · CVSS 8.2 High · Not analysed yet · Published 20 Jul 2026 · Tags: Information disclosure, CWE-212
- [Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins](https://agentprime.io/advisories/CVE-2026-16104.md)
  `CVE-2026-16104` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Hard-coded credentials, CWE-212
- [nebula-mesh: CA private key not zeroized on web mobile-bundle error paths](https://agentprime.io/advisories/GHSA-2p2f-px33-4vv5.md)
  `GHSA-2p2f-px33-4vv5`, `CVE-2026-53604`, `GO-2026-5984` · Go `github.com/forgekeep/nebula-mesh`: affected `<0.3.8`, fixed in `0.3.8` · CVSS 7.1 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-212, CWE-316
- [OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties](https://agentprime.io/advisories/GHSA-j4cw-mcg2-2q78.md)
  `GHSA-j4cw-mcg2-2q78`, `CVE-2026-54421`, `PYSEC-2026-3852` · PyPI `ironic`: affected `>=17.0.0, <29.0.6 || >=30.0.0, <32.0.2 || >=33.0.0, <35.0.2 || >=36.0.0, <37.0.1`, fixed in `29.0.6`, `32.0.2`, `35.0.2`, `37.0.1` · CVSS 6.8 Medium · Not analysed yet · Published 14 Jun 2026 · Tags: CWE-212
- [Bludit's persistent authentication tokens not revoked upon account disablement](https://agentprime.io/advisories/CVE-2026-46657.md)
  `CVE-2026-46657` · CVE record: bludit bludit · CVSS 7.1 High · Not analysed yet · Published 8 Jun 2026 · Tags: Authentication bypass, CWE-212
- [The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configuration partition, possibly allowing attackers to recover and obtain sensitive u…](https://agentprime.io/advisories/CVE-2026-36178.md)
  `CVE-2026-36178` · CVE record · CVSS 4.6 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-212
- [Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations](https://agentprime.io/advisories/GHSA-rg3g-4rw9-gqrp.md)
  `GHSA-rg3g-4rw9-gqrp`, `BIT-argo-cd-2026-45737`, `CVE-2026-45737`, `GO-2026-5618` · Go `github.com/argoproj/argo-cd/v3`: affected `>=3.2.0, <3.2.12 || >=3.3.0-rc1, <3.3.10 || >=3.4.0-rc1, <3.4.2`, fixed in `3.2.12`, `3.3.10`, `3.4.2` · CVSS 6.3 Medium · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure, CWE-212
- [Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content](https://agentprime.io/advisories/GHSA-f3jg-756w-gm35.md)
  `GHSA-f3jg-756w-gm35`, `CVE-2026-45046`, `GO-2026-5345` · Go `github.com/safedep/gryph`: affected `<0.7.0`, fixed in `0.7.0` · CVSS 5.5 Medium · Not analysed yet · Published 11 May 2026 · Tags: CWE-212
- [FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download](https://agentprime.io/advisories/GHSA-q7f2-rv22-2xgr.md)
  `GHSA-q7f2-rv22-2xgr`, `CVE-2026-27892`, `PKSA-zck8-p11k-g1qj` · Packagist `facturascripts/facturascripts`: affected `<2026`, fixed in `2026` · CVSS 6.5 Medium · Not analysed yet · Published 7 May 2026 · Tags: Information disclosure, CWE-212
- [Phoenix Contact: Improper removal of sensitive information in MGUARD products](https://agentprime.io/advisories/CVE-2024-43384.md)
  `CVE-2024-43384` · CVE record: PHOENIX CONTACT FL MGUARD 2102 and 4 more · CVSS 8.0 High · Not analysed yet · Published 7 May 2026 · Tags: CWE-212
- [ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction](https://agentprime.io/advisories/GHSA-3v3m-wc6v-x4x3.md)
  `GHSA-3v3m-wc6v-x4x3`, `BIT-argo-cd-2026-42880`, `CVE-2026-42880`, `CVE-2026-43824`, `GO-2026-5099` · Go `github.com/argoproj/argo-cd/v3`: affected `>=3.2.0, <3.2.11 || >=3.3.0, <3.3.9`, fixed in `3.2.11`, `3.3.9` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 May 2026 · Tags: Information disclosure, CWE-212
- [OpenBao's Namespace Deletion May Not Delete Data Properly](https://agentprime.io/advisories/GHSA-vv66-6rp4-wr4f.md)
  `GHSA-vv66-6rp4-wr4f`, `BIT-openbao-2026-42186`, `CVE-2026-42186`, `GO-2026-5674` · Go `github.com/openbao/openbao`: affected `<0.0.0-20260420173541-6d2e0506e2b4`, fixed in `0.0.0-20260420173541-6d2e0506e2b4` · CVSS 2.3 Low · Not analysed yet · Published 5 May 2026 · Tags: CWE-212
- [OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases](https://agentprime.io/advisories/GHSA-8372-7vhw-cm6q.md)
  `GHSA-8372-7vhw-cm6q`, `CVE-2026-43528` · npm `openclaw`: affected `<2026.4.14`, fixed in `2026.4.14` · CVSS 7.1 High · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-212
- [Windows Recovery Environment Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-20928.md)
  `CVE-2026-20928` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 4.6 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-212
- [follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets](https://agentprime.io/advisories/GHSA-r4q5-vmmm-2653.md)
  `GHSA-r4q5-vmmm-2653`, `CVE-2026-40895` · npm `follow-redirects`: affected `<1.16.0`, fixed in `1.16.0` · CVSS 6.9 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Information disclosure, CWE-212
- [Global vanishing does not completely remove user email](https://agentprime.io/advisories/CVE-2026-39937.md)
  `CVE-2026-39937` · CVE record: The Wikimedia Foundation Mediawiki - CentralAuth Extension · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-212
- [OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes](https://agentprime.io/advisories/GHSA-j9pv-rrcj-6pfx.md)
  `GHSA-j9pv-rrcj-6pfx`, `CVE-2026-41357` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 2.0 Low · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-212, CWE-214
- [Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON](https://agentprime.io/advisories/GHSA-x27p-5f68-m644.md)
  `GHSA-x27p-5f68-m644`, `CVE-2026-34214` · Maven `io.trino:trino-iceberg`: affected `>=439, <480`, fixed in `480` · CVSS 7.7 High · Not analysed yet · Published 29 Mar 2026 · Tags: Information disclosure, CWE-212
- [OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status](https://agentprime.io/advisories/GHSA-ppwq-6v66-5m6j.md)
  `GHSA-ppwq-6v66-5m6j`, `CVE-2026-35644` · npm `openclaw`: affected `<2026.3.22`, fixed in `2026.3.22` · CVSS 7.1 High · Not analysed yet · Published 26 Mar 2026 · Tags: Information disclosure, Hard-coded credentials, CWE-212
- [Anchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSS](https://agentprime.io/advisories/CVE-2026-32891.md)
  `CVE-2026-32891` · CVE record: openVESSL Anchorr · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2026 · Tags: Cross-site scripting (XSS), Weak cryptography or TLS, CWE-212
- [Improper Removal of Sensitive Information Before Storage or Transfer in GitLab](https://agentprime.io/advisories/CVE-2026-1182.md)
  `CVE-2026-1182` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: CWE-212
- [Improper Removal of Sensitive Information Before Storage or Transfer in GitLab](https://agentprime.io/advisories/CVE-2026-1732.md)
  `CVE-2026-1732` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-212
- [tfplan2md has Sensitive Value Exposure in Generated Reports](https://agentprime.io/advisories/CVE-2026-27640.md)
  `CVE-2026-27640` · CVE record: oocx tfplan2md · CVSS 8.5 High · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-212
- [Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback](https://agentprime.io/advisories/CVE-2025-8860.md)
  `CVE-2025-8860` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 3.3 Low · Not analysed yet · Published 18 Feb 2026 · Tags: CWE-212
- [Coolify leaksensitive information \`email_change_code\` in \`/api/v1/teams/{team_id | current}/members\` API endpoint](https://agentprime.io/advisories/CVE-2025-59955.md)
  `CVE-2025-59955` · CVE record: coollabsio coolify · CVSS 5.7 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Information disclosure, CWE-212, CWE-214
- [CBORDecoder reuse can leak shareable values across decode calls](https://agentprime.io/advisories/GHSA-wcj4-jw5j-44wh.md)
  `GHSA-wcj4-jw5j-44wh`, `CVE-2025-68131`, `PYSEC-2025-90` · PyPI `cbor2`: affected `>=3.0.0, <5.8.0`, fixed in `5.8.0` · CVSS 5.5 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: CWE-212
- [URI Credential Leakage Bypass over CVE-2025-27221](https://agentprime.io/advisories/GHSA-j4pr-3wm6-xx2r.md)
  `GHSA-j4pr-3wm6-xx2r`, `CVE-2025-61594` · RubyGems `uri`: affected `<0.12.5 || >=0.13.0, <0.13.3 || >=1.0.0, <1.0.4`, fixed in `0.12.5`, `0.13.3`, `1.0.4` · CVSS 2.1 Low · Not analysed yet · Published 30 Dec 2025 · Tags: Information disclosure, CWE-212
- [Unintended temporary cached data included in a structure only copy intended to be empty of data](https://agentprime.io/advisories/CVE-2025-14267.md)
  `CVE-2025-14267` · CVE record: M-Files Corporation M-Files Server · CVSS 5.6 Medium · Not analysed yet · Published 19 Dec 2025 · Tags: CWE-212
- [Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule](https://agentprime.io/advisories/CVE-2025-65000.md)
  `CVE-2025-65000` · CVE record: Checkmk GmbH Checkmk · CVSS 2.3 Low · Not analysed yet · Published 18 Dec 2025 · Tags: CWE-212
- [Grype has a credential disclosure vulnerability in its JSON output](https://agentprime.io/advisories/GHSA-6gxw-85q2-q646.md)
  `GHSA-6gxw-85q2-q646`, `CVE-2025-65965`, `GO-2025-4160` · Go `github.com/anchore/grype`: affected `>=0.68.0, <0.104.1`, fixed in `0.104.1` · CVSS 8.2 High · Not analysed yet · Published 25 Nov 2025 · Tags: CWE-212
- [Zoom Clients - Improper Removal of Sensitive Information](https://agentprime.io/advisories/CVE-2025-62483.md)
  `CVE-2025-62483` · CVE record: Zoom Communications Inc. Zoom Clients · CVSS 5.3 Medium · Not analysed yet · Published 13 Nov 2025 · Tags: CWE-212
- [Weblate leaks the IP of project member inviting user to be reviewer in Audit log](https://agentprime.io/advisories/GHSA-gr35-vpx2-qxhc.md)
  `GHSA-gr35-vpx2-qxhc`, `CVE-2025-64326`, `PYSEC-2025-126`, `PYSEC-2025-230` · PyPI `weblate`: affected `<5.14.1`, fixed in `5.14.1` · CVSS 2.6 Low · Not analysed yet · Published 5 Nov 2025 · Tags: CWE-212
- [Shopware exposes sensitive user information via CSV export mapping](https://agentprime.io/advisories/GHSA-27c9-vp3w-6ww8.md)
  `GHSA-27c9-vp3w-6ww8`, `PKSA-cb17-wqsx-y85w`, `PKSA-kypv-cx5n-qkc8` · Packagist `shopware/core` and 1 more: affected `<6.6.10.7 || >=6.7.0.0, <6.7.3.1`, fixed in `6.6.10.7`, `6.7.3.1` · CVSS 4.9 Medium · Not analysed yet · Published 21 Oct 2025 · Tags: CWE-212
- [Improper removal of sensitive information before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address information potentially resulting in loss of confidentialit…](https://agentprime.io/advisories/CVE-2025-0011.md)
  `CVE-2025-0011` · CVE record: AMD AMD Ryzen™ 8000 Series Desktop Processors and 4 more · CVSS 3.3 Low · Not analysed yet · Published 6 Sept 2025 · Tags: CWE-212
- [XWiki PDF export jobs store sensitive cookies unencrypted in job statuses](https://agentprime.io/advisories/GHSA-9m7c-m33f-3429.md)
  `GHSA-9m7c-m33f-3429`, `CVE-2025-58049` · Maven `org.xwiki.platform:xwiki-platform-export-pdf-api`: affected `>=14.4.2, <16.4.8 || >=16.5.0-rc-1, <16.10.7 || >=17.0.0-rc-1, <17.4.0-rc-1`, fixed in `16.4.8`, `16.10.7`, `17.4.0-rc-1` · CVSS 5.8 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: CWE-212, CWE-257
- [Contao can disclose sensitive information in the news module](https://agentprime.io/advisories/GHSA-w53m-gxvg-vx7p.md)
  `GHSA-w53m-gxvg-vx7p`, `CVE-2025-57757`, `PKSA-kh11-db67-t9zk`, `PKSA-v6p5-ssqr-1zcw` · Packagist `contao/contao` and 1 more: affected `>=5.0.0-RC1, <5.3.38 || >=5.4.0-RC1, <5.6.1`, fixed in `5.3.38`, `5.6.1` · CVSS 5.3 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Information disclosure, CWE-212
- [Directus tokens are not redacted in flow logs, exposing session credentials to all admin](https://agentprime.io/advisories/GHSA-f24x-rm6g-3w5v.md)
  `GHSA-f24x-rm6g-3w5v`, `CVE-2025-53886` · npm `directus`: affected `<11.9.0`, fixed in `11.9.0` · CVSS 4.5 Medium · Not analysed yet · Published 15 Jul 2025 · Tags: Information disclosure, CWE-212
- [Artifex Ghostscript: gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1…](https://agentprime.io/advisories/CVE-2025-48708.md)
  `CVE-2025-48708` · CVE record: Artifex Ghostscript · CVSS 4.0 Medium · Not analysed yet · Published 23 May 2025 · Tags: CWE-212
- [URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+](https://agentprime.io/advisories/GHSA-22h5-pq3x-2gf2.md)
  `GHSA-22h5-pq3x-2gf2`, `CVE-2025-27221` · RubyGems `uri`: affected `<0.11.3 || >=0.12.0, <0.12.4 || >=0.13.0, <0.13.2 || >=1.0.0, <1.0.3`, fixed in `0.11.3`, `0.12.4`, `0.13.2`, `1.0.3` · CVSS 3.2 Low · Not analysed yet · Published 3 Mar 2025 · Tags: Information disclosure, CWE-212
- [Cisco Application Policy Infrastructure Controller Authenticated Command Injection Due to Sensitive Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2025-20118.md)
  `CVE-2025-20118` · CVE record: Cisco Cisco Application Policy Infrastructure Controller (APIC) · CVSS 4.4 Medium · Not analysed yet · Published 26 Feb 2025 · Tags: CWE-212
- [kube-audit-rest's example logging configuration could disclose secret values in the audit log in github.com/RichardoC/kube-audit-rest](https://agentprime.io/advisories/GHSA-hcr5-wv4p-h2g2.md)
  `GHSA-hcr5-wv4p-h2g2`, `CVE-2025-24884`, `GO-2025-3431` · Go `github.com/RichardoC/kube-audit-rest`: affected `<0.0.0-20250129191722-db1aa5b86725`, fixed in `0.0.0-20250129191722-db1aa5b86725` · CVSS 5.1 Medium · Not analysed yet · Published 4 Feb 2025 · Tags: Information disclosure, CWE-212

Older: <https://agentprime.io/advisories/tag/cwe-212.md?cursor=WyIyMDI1LTAyLTA0VDIyOjA2OjExLjAwMDAwMFoiLCJHSFNBLWhjcjUtd3Y0cC1oMmcyIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-212>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-212/>. Everything for agents: <https://agentprime.io/llms.txt>.