# Information disclosure. Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first - [FlexNet Beacon Missing Authentication Vulnerability](https://agentprime.io/advisories/CVE-2026-110390.md) `CVE-2026-110390` · CVE record: Flexera FlexNet Beacon and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass, Information disclosure - [BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure](https://agentprime.io/advisories/CVE-2026-119757.md) `CVE-2026-119757` · CVE record: BTCPay Server BTCPay Server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Hard-coded credentials, Information disclosure - [OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading](https://agentprime.io/advisories/CVE-2026-103021.md) `CVE-2026-103021` · CVE record: openemr openemr · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, CWE-208 - [OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions](https://agentprime.io/advisories/CVE-2026-103020.md) `CVE-2026-103020` · CVE record: openemr openemr · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Authentication bypass - [OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot](https://agentprime.io/advisories/CVE-2026-65983.md) `CVE-2026-65983` · CVE record: openemr openemr · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure - [Observable discrepancy in OpenText Directory Services (OTDS)](https://agentprime.io/advisories/CVE-2026-19134.md) `CVE-2026-19134` · CVE record: OpenText OpenText Directory Services (OTDS) · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure - [FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via \`${variable:offset}\` slicing](https://agentprime.io/advisories/CVE-2026-116780.md) `CVE-2026-116780` · CVE record: signalwire freeswitch · CVSS 2.7 Low · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, Information disclosure - [WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files](https://agentprime.io/advisories/CVE-2026-123197.md) `CVE-2026-123197` · CVE record: wppconnect wppconnect-server · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure - [Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9](https://agentprime.io/advisories/CVE-2026-118494.md) `CVE-2026-118494` · CVE record: jreviews.com JReviews component for Joomla · CVSS 8.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure - [OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)](https://agentprime.io/advisories/CVE-2026-54145.md) `CVE-2026-54145` · CVE record: tinyhumansai openhuman · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure - [OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data](https://agentprime.io/advisories/CVE-2026-49405.md) `CVE-2026-49405` · CVE record: tinyhumansai openhuman · CVSS 6.2 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Authentication bypass - [OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture](https://agentprime.io/advisories/CVE-2026-54144.md) `CVE-2026-54144` · CVE record: tinyhumansai openhuman · CVSS 6.1 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, Information disclosure - [Apache OFBiz: Unauthenticated HR organization and employee disclosure](https://agentprime.io/advisories/CVE-2026-73580.md) `CVE-2026-73580` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Broken access control - [Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers](https://agentprime.io/advisories/CVE-2026-83538.md) `CVE-2026-83538` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Broken access control - [Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts](https://agentprime.io/advisories/CVE-2026-123059.md) `CVE-2026-123059` · CVE record: Eclipse Foundation Eclipse BaSyx Helm Charts · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Hard-coded credentials - [Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts](https://agentprime.io/advisories/CVE-2026-123047.md) `CVE-2026-123047` · CVE record: Eclipse Foundation Eclipse BaSyx Helm Charts · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Hard-coded credentials - [Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults](https://agentprime.io/advisories/CVE-2026-73101.md) `CVE-2026-73101` · CVE record: Apache Software Foundation Apache Juneau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure - [Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors](https://agentprime.io/advisories/CVE-2026-73100.md) `CVE-2026-73100` · CVE record: Apache Software Foundation Apache Juneau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure - [Sensitive information in error messages in Red Hat ansible-core](https://agentprime.io/advisories/CVE-2026-123036.md) `CVE-2026-123036` · CVE record: Red Hat ansible-core · CVSS 5.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure - [LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching](https://agentprime.io/advisories/CVE-2026-93389.md) `CVE-2026-93389` · CVE record: litespeedtech LiteSpeed Cache · CVSS 8.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure - [Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response](https://agentprime.io/advisories/CVE-2026-122301.md) `CVE-2026-122301` · CVE record: parse-community parse-server · CVSS 2.3 Low · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure - [purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure](https://agentprime.io/advisories/CVE-2026-122154.md) `CVE-2026-122154` · CVE record: purocean Yank Note · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Broken access control - [NST Labs Tech Nstbrowser Local Agent API info information disclosure](https://agentprime.io/advisories/CVE-2026-122028.md) `CVE-2026-122028` · CVE record: NST Labs Tech Nstbrowser · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure, Broken access control - [Sandboxie-Plus: Sandbox containment bypass](https://agentprime.io/advisories/CVE-2026-102280.md) `CVE-2026-102280` · CVE record: sandboxie-plus Sandboxie · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure, Broken access control, CWE-390, CWE-636 - [nvm prints the contents of any readable file through a symlinked .nvmrc](https://agentprime.io/advisories/CVE-2026-121747.md) `CVE-2026-121747` · CVE record: nvm-sh nvm · CVSS 6.7 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal, Information disclosure, CWE-61 - [Multiple vulnerabilities that affects IBM Db2 Genius Hub](https://agentprime.io/advisories/CVE-2026-105702.md) `CVE-2026-105702` · CVE record: IBM Db2 Genius Hub · CVSS 4.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [Traccar: Authentication bypass via path parameters exposes protected device media](https://agentprime.io/advisories/CVE-2026-104203.md) `CVE-2026-104203` · CVE record: traccar traccar · CVSS 7.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure, Authentication bypass - [vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service](https://agentprime.io/advisories/CVE-2025-71455.md) `CVE-2025-71455` · CVE record: vtenext vtenext · CVSS 5.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [IBM MQ is affected by a pasword disclosure vulnerability in the runmqccred utility](https://agentprime.io/advisories/CVE-2026-14252.md) `CVE-2026-14252` · CVE record: IBM MQ · CVSS 6.2 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References](https://agentprime.io/advisories/CVE-2026-121971.md) `CVE-2026-121971` · CVE record: sensiolabs symfony · CVSS 8.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure, Hard-coded credentials - [Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735](https://agentprime.io/advisories/GHSA-93cm-2v4m-c56c.md) `GHSA-93cm-2v4m-c56c`, `CVE-2026-55098`, `GO-2026-6913` · Go `github.com/basekick-labs/arc`: affected `<0.0.0-20260610131716-5dc8f53b70a3`, fixed in `0.0.0-20260610131716-5dc8f53b70a3` · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure, Broken access control - [Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller](https://agentprime.io/advisories/CVE-2026-91163.md) `CVE-2026-91163` · CVE record: warp-tech warpgate · CVSS 3.7 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [Information Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile application](https://agentprime.io/advisories/CVE-2026-121146.md) `CVE-2026-121146` · CVE record: Tata Motors Tata Motors iRA 2.0 and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [Apache OpenOffice: Local file inclusion via GStreamer plugin](https://agentprime.io/advisories/CVE-2026-90632.md) `CVE-2026-90632` · CVE record: Apache Software Foundation Apache OpenOffice · No CVSS score · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [Apache OpenOffice: Local file inclusion via SQL provider and flat file database references](https://agentprime.io/advisories/CVE-2026-90627.md) `CVE-2026-90627` · CVE record: Apache Software Foundation Apache OpenOffice · CVSS 5.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-56065.md) `CVE-2026-56065` · CVE record: Doofinder Doofinder for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via \[sdm_show_download_info\] Shortcode](https://agentprime.io/advisories/CVE-2026-118637.md) `CVE-2026-118637` · CVE record: Unknown Simple Download Monitor · CVSS 2.7 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override](https://agentprime.io/advisories/CVE-2026-118523.md) `CVE-2026-118523` · CVE record: Unknown EventPrime · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR](https://agentprime.io/advisories/CVE-2026-118404.md) `CVE-2026-118404` · CVE record: Unknown Premium Packages · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points](https://agentprime.io/advisories/CVE-2026-112244.md) `CVE-2026-112244` · CVE record: Unknown Duplicator and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [WP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export File](https://agentprime.io/advisories/CVE-2026-111962.md) `CVE-2026-111962` · CVE record: Unknown WP Remote Users Sync · CVSS 3.7 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure](https://agentprime.io/advisories/CVE-2026-111740.md) `CVE-2026-111740` · CVE record: Unknown Post Duplicator · CVSS 2.7 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [WP ERP < 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit Log](https://agentprime.io/advisories/CVE-2026-105191.md) `CVE-2026-105191` · CVE record: Unknown ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure - [Linksys E5600 Factory Quality Control fqc.cgi information disclosure](https://agentprime.io/advisories/CVE-2026-121618.md) `CVE-2026-121618` · CVE record: Linksys E5600 · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure, Broken access control - [MailEnable Auth Cleartext Storage Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-114551.md) `CVE-2026-114551` · CVE record: MailEnable MailEnable · CVSS 5.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Tanium addressed an information disclosure vulnerability in Discover.](https://agentprime.io/advisories/CVE-2026-116666.md) `CVE-2026-116666` · CVE record: Tanium Discover · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Tanium addressed an information disclosure vulnerability in Discover.](https://agentprime.io/advisories/CVE-2026-116665.md) `CVE-2026-116665` · CVE record: Tanium Discover · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Resource exposure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121175.md) `CVE-2026-121175` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-121130.md) `CVE-2026-121130` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-121138.md) `CVE-2026-121138` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Resource exposure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121168.md) `CVE-2026-121168` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121235.md) `CVE-2026-121235` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121125.md) `CVE-2026-121125` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121243.md) `CVE-2026-121243` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121158.md) `CVE-2026-121158` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-121223.md) `CVE-2026-121223` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121132.md) `CVE-2026-121132` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-121187.md) `CVE-2026-121187` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121239.md) `CVE-2026-121239` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121254.md) `CVE-2026-121254` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .