# Information disclosure. Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-78893.md) `CVE-2026-78893` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-79030.md) `CVE-2026-79030` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-79274.md) `CVE-2026-79274` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-78895.md) `CVE-2026-78895` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-78908.md) `CVE-2026-78908` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure - [OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure](https://agentprime.io/advisories/CVE-2026-62986.md) `CVE-2026-62986` · CVE record: AcademySoftwareFoundation openexr · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure, Memory corruption - [phpMyFAQ public FAQ APIs expose inactive FAQ content](https://agentprime.io/advisories/GHSA-mf8r-wm2w-f8c5.md) `GHSA-mf8r-wm2w-f8c5`, `CVE-2026-57994`, `PKSA-5ym8-q7sn-cqmx`, `PKSA-g5hk-s1sp-5tnd` · Packagist `phpmyfaq/phpmyfaq` and 1 more: affected `>=4.1.0, <4.1.5`, fixed in `4.1.5` · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure, Broken access control - [urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage](https://agentprime.io/advisories/GHSA-hq3h-g68c-hp78.md) `GHSA-hq3h-g68c-hp78`, `CVE-2026-55553` · npm `urllib`: affected `<2.44.1 || >=3.0.0, <4.9.1`, fixed in `2.44.1`, `4.9.1` · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure, Hard-coded credentials - [rclone before 1.75.0 Authentication Bypass via pprof](https://agentprime.io/advisories/CVE-2026-79776.md) `CVE-2026-79776` · CVE record: rclone rclone · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure - [HCL Hive is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-21758.md) `CVE-2026-21758` · CVE record: HCL Software Hive · CVSS 3.7 Low · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure - [Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)](https://agentprime.io/advisories/PKSA-vy31-xjc7-3g2h.md) `PKSA-vy31-xjc7-3g2h`, `CVE-2026-107842` · Packagist `contao/contao`: affected `>=4.0.0, <5.3.50 || >=5.4.0, <5.7.12`, fixed in `5.3.50`, `5.7.12` · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure - [Duplicate Advisory: Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths](https://agentprime.io/advisories/GHSA-mw85-cjh9-8hp7.md) `GHSA-mw85-cjh9-8hp7` · Packagist `getgrav/grav`: affected `*`, no fixed version yet · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure - [Grav Login Plugin before 3.9.1 Email Enumeration via Registration](https://agentprime.io/advisories/CVE-2026-72699.md) `CVE-2026-72699` · CVE record: getgrav grav-plugin-login · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure - [WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-78268.md) `CVE-2026-78268` · CVE record: Extend Themes Lead Generation Contact Widget \& AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads · CVSS 7.5 High · Not analysed yet · Published 24 Aug 2026 · Tags: Information disclosure - [RansomLook API Key Disclosure Through /admin/apikeys HTML Source](https://agentprime.io/advisories/CVE-2026-78555.md) `CVE-2026-78555` · CVE record: ransomlook ransomlook · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Information disclosure, Hard-coded credentials - [Apache Allura: Unauthenticated REST disclosure](https://agentprime.io/advisories/CVE-2026-75099.md) `CVE-2026-75099` · CVE record: Apache Software Foundation Apache Allura · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Information disclosure - [Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder](https://agentprime.io/advisories/CVE-2026-13343.md) `CVE-2026-13343` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Information disclosure - [Unauthenticated Disclosure of Scraping Credentials and Bypass Configuration via RansomLook API](https://agentprime.io/advisories/CVE-2026-78386.md) `CVE-2026-78386` · CVE record: ransomlook ransomlook · CVSS 8.7 High · Not analysed yet · Published 24 Aug 2026 · Tags: Information disclosure - [Redis Glob Pattern Injection Allows Unauthorized Enumeration of Private Ransomlook Data](https://agentprime.io/advisories/CVE-2026-78378.md) `CVE-2026-78378` · CVE record: ransomlook ransomlook · CVSS 6.9 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Information disclosure - [WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-66585.md) `CVE-2026-66585` · CVE record: WPCafe WP Cafe Pro · CVSS 7.5 High · Not analysed yet · Published 24 Aug 2026 · Tags: Information disclosure - [Information Disclosure via 'Copy learned MAC Addresses' Function](https://agentprime.io/advisories/CVE-2026-8173.md) `CVE-2026-8173` · CVE record: Murrelektronik Xelity 4TX M GE and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Information disclosure - [OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().](https://agentprime.io/advisories/CVE-2026-75464.md) `CVE-2026-75464` · CVE record · CVSS 8.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: Information disclosure - [alexta69 MeTube Cookie File cookies.txt file access](https://agentprime.io/advisories/CVE-2026-78051.md) `CVE-2026-78051` · CVE record: alexta69 MeTube · CVSS 6.9 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Broken access control, Information disclosure - [SiYuan before v3.8.0 Secret Exfiltration via http_request URL](https://agentprime.io/advisories/CVE-2026-59809.md) `CVE-2026-59809` · CVE record: siyuan-note siyuan · CVSS 6.9 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Information disclosure - [WWBN AVideo Unbound Token Authorization Bypass via Gallery](https://agentprime.io/advisories/CVE-2026-59256.md) `CVE-2026-59256` · CVE record: WWBN AVideo · CVSS 8.7 High · Not analysed yet · Published 22 Aug 2026 · Tags: Information disclosure - [AVideo feed/index.php Exposure of Channel Owner Email Address](https://agentprime.io/advisories/CVE-2026-56380.md) `CVE-2026-56380` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Information disclosure - [Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path](https://agentprime.io/advisories/CVE-2026-19093.md) `CVE-2026-19093` · CVE record: Unknown Tutor LMS · CVSS 6.8 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Information disclosure - [FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure](https://agentprime.io/advisories/CVE-2026-16612.md) `CVE-2026-16612` · CVE record: Unknown FiboSearch · CVSS 5.3 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Information disclosure - [Combodo iTop: Access control bypass via OQL joins](https://agentprime.io/advisories/CVE-2026-34948.md) `CVE-2026-34948` · CVE record: Combodo iTop · CVSS 7.7 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Combodo iTop: Information disclosure in ajax.render.php](https://agentprime.io/advisories/CVE-2026-33333.md) `CVE-2026-33333` · CVE record: Combodo iTop · CVSS 3.5 Low · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)](https://agentprime.io/advisories/CVE-2026-53497.md) `CVE-2026-53497` · CVE record: cenodude CrossWatch · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [information disclosure vulnerability in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69225.md) `CVE-2026-69225` · CVE record: Esri Portal for ArcGIS · CVSS 5.9 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [information disclosure vulnerability in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69224.md) `CVE-2026-69224` · CVE record: Esri Portal for ArcGIS · CVSS 5.9 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution](https://agentprime.io/advisories/CVE-2026-62316.md) `CVE-2026-62316` · CVE record: microsoft UFO · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure, CWE-346 - [Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows](https://agentprime.io/advisories/CVE-2026-62960.md) `CVE-2026-62960` · CVE record: git-for-windows git · CVSS 7.4 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure, CWE-610 - [Combodo iTop: Version disclosure via login page logo](https://agentprime.io/advisories/CVE-2026-27463.md) `CVE-2026-27463` · CVE record: Combodo iTop · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Combodo iTop: Insecured access to uploaded images via sniffed url](https://agentprime.io/advisories/CVE-2026-30866.md) `CVE-2026-30866` · CVE record: Combodo iTop · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure, Authentication bypass - [Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5](https://agentprime.io/advisories/CVE-2026-67361.md) `CVE-2026-67361` · CVE record: j2commerce.com J2Store extension for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site request forgery (CSRF), Information disclosure - [Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled](https://agentprime.io/advisories/CVE-2026-71862.md) `CVE-2026-71862` · CVE record: bluewave-labs Checkmate · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure, Hard-coded credentials - [Brushfire unauthenticated information disclosure](https://agentprime.io/advisories/CVE-2026-75928.md) `CVE-2026-75928` · CVE record: Brushfire Online Experience · CVSS 6.9 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation](https://agentprime.io/advisories/CVE-2026-59308.md) `CVE-2026-59308` · CVE record: Spring Spring AI · CVSS 4.2 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Apache CloudStack: Improper access control in Userdata reference APIs](https://agentprime.io/advisories/CVE-2026-50222.md) `CVE-2026-50222` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure, Broken access control - [Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure](https://agentprime.io/advisories/CVE-2026-59655.md) `CVE-2026-59655` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob](https://agentprime.io/advisories/CVE-2026-59657.md) `CVE-2026-59657` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Apache CloudStack: LDAP provider configuration disclosure](https://agentprime.io/advisories/CVE-2026-59780.md) `CVE-2026-59780` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Apache CloudStack: OAuth2 Token Cross-Request Leak](https://agentprime.io/advisories/CVE-2026-61397.md) `CVE-2026-61397` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Apache CloudStack: Webhook Deliveries Incorrect Access](https://agentprime.io/advisories/CVE-2026-65613.md) `CVE-2026-65613` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 4.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure, Broken access control - [Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure](https://agentprime.io/advisories/CVE-2026-19435.md) `CVE-2026-19435` · CVE record: Unknown Duplicate Post · CVSS 2.7 Low · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint](https://agentprime.io/advisories/CVE-2026-16575.md) `CVE-2026-16575` · CVE record: Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-17060.md) `CVE-2026-17060` · CVE record: IBM AIX and 1 more · CVSS 8.1 High · Not analysed yet · Published 20 Aug 2026 · Tags: Information disclosure - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16973.md) `CVE-2026-16973` · CVE record: IBM AIX and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Information disclosure - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16964.md) `CVE-2026-16964` · CVE record: IBM AIX and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Information disclosure - [Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)](https://agentprime.io/advisories/GHSA-8r62-w5wh-fc5m.md) `GHSA-8r62-w5wh-fc5m`, `CVE-2026-67448`, `GO-2026-6271` · Go `github.com/axllent/mailpit`: affected `>=1.29.0, <1.30.6`, fixed in `1.30.6` · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Information disclosure, CWE-177, CWE-346 - [Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace](https://agentprime.io/advisories/CVE-2026-73137.md) `CVE-2026-73137` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 and 4 more · CVSS 7.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: Information disclosure - [Winter: Local File Inclusion through =include directives in JavaScript asset compilation](https://agentprime.io/advisories/GHSA-2223-f22x-24cq.md) `GHSA-2223-f22x-24cq`, `CVE-2026-79773`, `PKSA-xv7p-39zk-tqqd` · Packagist `winter/wn-system-module`: affected `<1.2.13`, fixed in `1.2.13` · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Path traversal, Information disclosure - [netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages](https://agentprime.io/advisories/GHSA-2mc4-j865-9q4r.md) `GHSA-2mc4-j865-9q4r`, `CVE-2026-61798` · Maven `io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl`: affected `<0.0.23.Final`, fixed in `0.0.23.Final` · CVSS 8.1 High · Not analysed yet · Published 20 Aug 2026 · Tags: Information disclosure - [NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution](https://agentprime.io/advisories/GHSA-ghvf-qf6h-g8x5.md) `GHSA-ghvf-qf6h-g8x5` · npm `@nocobase/server`: affected `<2.1.5`, fixed in `2.1.5` · No CVSS score · Not analysed yet · Published 20 Aug 2026 · Tags: Path traversal, Information disclosure, Unrestricted file upload, CWE-829 - [libgit2: HTTP transport can leak credentials to an offsite redirect target](https://agentprime.io/advisories/CVE-2026-53586.md) `CVE-2026-53586` · CVE record: libgit2 libgit2 · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Information disclosure, Hard-coded credentials, Open redirect - [next-video: Unauthenticated arbitrary file read via /api/video request handler](https://agentprime.io/advisories/GHSA-2p39-2jf3-fv2q.md) `GHSA-2p39-2jf3-fv2q`, `CVE-2026-54150` · npm `next-video`: affected `<2.8.1`, fixed in `2.8.1` · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Path traversal, Information disclosure - [Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison](https://agentprime.io/advisories/GHSA-8fxq-53rx-ph5f.md) `GHSA-8fxq-53rx-ph5f`, `CVE-2026-111933`, `GO-2026-6265` · Go `github.com/coder/coder/v2`: affected `<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2`, fixed in `2.29.17`, `2.32.7`, `2.33.8`, `2.34.2` · CVSS 6.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Information disclosure, CWE-204 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .