# Information disclosure. Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files](https://agentprime.io/advisories/CVE-2026-79631.md) `CVE-2026-79631` · CVE record: Unknown WPFunnels · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Information disclosure - [Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback](https://agentprime.io/advisories/CVE-2026-74853.md) `CVE-2026-74853` · CVE record: Unknown Pods · CVSS 6.8 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Information disclosure - [Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter](https://agentprime.io/advisories/CVE-2026-17517.md) `CVE-2026-17517` · CVE record: Unknown Content Views · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Information disclosure - [An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to retriev…](https://agentprime.io/advisories/CVE-2026-75164.md) `CVE-2026-75164` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Information disclosure - [An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 returns detailed system version fields (operatingsystem,…](https://agentprime.io/advisories/CVE-2026-75163.md) `CVE-2026-75163` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Information disclosure - [An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any remote authenticated user, including use…](https://agentprime.io/advisories/CVE-2026-75162.md) `CVE-2026-75162` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Information disclosure - [An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components](https://agentprime.io/advisories/CVE-2026-71626.md) `CVE-2026-71626` · CVE record · CVSS 7.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Information disclosure - [Files accessible to external parties in WebPros ConfigServer Security & Firewall and others](https://agentprime.io/advisories/CVE-2026-67402.md) `CVE-2026-67402` · CVE record: WebPros ConfigServer Security & Firewall and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Information disclosure - [SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents](https://agentprime.io/advisories/GHSA-vpjw-wf5h-cgpq.md) `GHSA-vpjw-wf5h-cgpq`, `CVE-2026-72804`, `GO-2026-6407` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260724091654-82e9ded423e4`, fixed in `0.0.0-20260724091654-82e9ded423e4` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Information disclosure, Broken access control - [Resource exposure in Google Chrome](https://agentprime.io/advisories/CVE-2026-85053.md) `CVE-2026-85053` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Sept 2026 · Tags: Information disclosure - [Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations](https://agentprime.io/advisories/CVE-2026-44506.md) `CVE-2026-44506` · CVE record: medplum medplum · CVSS 8.2 High · Not analysed yet · Published 3 Sept 2026 · Tags: Information disclosure - [WordPress KP Agent Ready plugin < 1.2.08 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-85307.md) `CVE-2026-85307` · CVE record: Kevin Pirnie KP Agent Ready · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Information disclosure - [CKAN MCP Server: Information disclosure via verbose error reflection](https://agentprime.io/advisories/GHSA-6f9w-9hf2-5rg3.md) `GHSA-6f9w-9hf2-5rg3`, `CVE-2026-73844` · npm `@aborruso/ckan-mcp-server`: affected `<0.4.112`, fixed in `0.4.112` · CVSS 3.7 Low · Not analysed yet · Published 3 Sept 2026 · Tags: Information disclosure, CWE-210 - [SiYuan before v3.8.2 API Token Exposure via Log File](https://agentprime.io/advisories/CVE-2026-85174.md) `CVE-2026-85174` · CVE record: siyuan-note siyuan · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Information disclosure - [n8n before 1.123.73 Credential Exposure via Error Logging](https://agentprime.io/advisories/CVE-2026-85171.md) `CVE-2026-85171` · CVE record: n8n-io n8n · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Information disclosure - [WWBN AVideo Broken Access Control via feed/index.php program_id](https://agentprime.io/advisories/CVE-2026-85157.md) `CVE-2026-85157` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Information disclosure - [WWBN AVideo Broken Access Control via Channel Page](https://agentprime.io/advisories/CVE-2026-85156.md) `CVE-2026-85156` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Information disclosure - [OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs](https://agentprime.io/advisories/GHSA-qh9r-j7rp-4x2m.md) `GHSA-qh9r-j7rp-4x2m`, `CVE-2026-73843`, `GO-2026-6362` · Go `github.com/openchoreo/openchoreo`: affected `<1.0.2 || >=1.1.0, <1.1.2`, fixed in `1.0.2`, `1.1.2` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass, Information disclosure, Broken access control - [Handlebars.java: Arbitrary file read in \`SpringTemplateLoader\` via URL-fragment suffix bypass](https://agentprime.io/advisories/GHSA-g29j-rwfv-h99w.md) `GHSA-g29j-rwfv-h99w`, `CVE-2026-63490` · Maven `com.github.jknack:handlebars-springmvc`: affected `<4.5.3`, fixed in `4.5.3` · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal, Information disclosure - [Hurl: Cookies in Cookies section leak when redirecting to a different host](https://agentprime.io/advisories/GHSA-7w2g-9mf9-324m.md) `GHSA-7w2g-9mf9-324m`, `CVE-2026-63481` · crates.io `hurl`: affected `<=8.0.1`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure - [Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)](https://agentprime.io/advisories/GHSA-mc5q-6hpj-rp7j.md) `GHSA-mc5q-6hpj-rp7j`, `CVE-2026-61450`, `CVE-2026-61842`, `PKSA-sq15-xbtt-m678` · Packagist `getgrav/grav`: affected `<2.0.2`, fixed in `2.0.2` · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection, Information disclosure - [Boruta: OAuth credentials exposed in Boruta business logs](https://agentprime.io/advisories/CVE-2026-55221.md) `CVE-2026-55221` · CVE record: malach-it boruta-server · CVSS 6.5 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure - [Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API](https://agentprime.io/advisories/CVE-2026-77123.md) `CVE-2026-77123` · CVE record: Sonatype Nexus Repository 3 · CVSS 6.0 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure - [Information disclosure in Jenkins Project Jenkins Script Security Plugin](https://agentprime.io/advisories/CVE-2026-84658.md) `CVE-2026-84658` · CVE record: Jenkins Project Jenkins Script Security Plugin · CVSS 4.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure - [DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112](https://agentprime.io/advisories/CVE-2026-81162.md) `CVE-2026-81162` · CVE record: Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure - [WordPress WooCommerce Product Attachment plugin <= 2.3.4 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-81774.md) `CVE-2026-81774` · CVE record: Dotstore WooCommerce Product Attachment · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure - [MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route](https://agentprime.io/advisories/CVE-2026-81199.md) `CVE-2026-81199` · CVE record: Unknown MasterStudy LMS WordPress Plugin · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure - [MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route](https://agentprime.io/advisories/CVE-2026-81197.md) `CVE-2026-81197` · CVE record: Unknown MasterStudy LMS WordPress Plugin · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure - [MasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route](https://agentprime.io/advisories/CVE-2026-81195.md) `CVE-2026-81195` · CVE record: Unknown MasterStudy LMS WordPress Plugin · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure - [FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response](https://agentprime.io/advisories/CVE-2026-78151.md) `CVE-2026-78151` · CVE record: Unknown FormLayer · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure - [Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt](https://agentprime.io/advisories/CVE-2026-77782.md) `CVE-2026-77782` · CVE record: Unknown Rank Math SEO · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure - [Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity](https://agentprime.io/advisories/CVE-2026-19251.md) `CVE-2026-19251` · CVE record: Unknown Ultimate Member · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure - [Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API](https://agentprime.io/advisories/CVE-2026-16983.md) `CVE-2026-16983` · CVE record: Unknown Gutentor · CVSS 4.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure - [Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content](https://agentprime.io/advisories/CVE-2026-16966.md) `CVE-2026-16966` · CVE record: Unknown Solace Extra · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-84348.md) `CVE-2026-84348` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-84359.md) `CVE-2026-84359` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [WWBN AVideo through 30.0 Information Disclosure via MobileManager](https://agentprime.io/advisories/CVE-2026-84481.md) `CVE-2026-84481` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Authenticated Sensitive Information Disclosure Vulnerabilities in AOS-CX](https://agentprime.io/advisories/CVE-2026-73775.md) `CVE-2026-73775` · CVE record: Hewlett Packard Enterprise (HPE) AOS-CX · CVSS 7.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer](https://agentprime.io/advisories/CVE-2026-73748.md) `CVE-2026-73748` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 2.2 Low · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API](https://agentprime.io/advisories/CVE-2026-73739.md) `CVE-2026-73739` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 4.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer](https://agentprime.io/advisories/CVE-2026-73738.md) `CVE-2026-73738` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 4.7 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Unauthenticated Limited Information Disclosure leads to Data Exposure in HPE Networking Fabric Composer](https://agentprime.io/advisories/CVE-2026-73736.md) `CVE-2026-73736` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Authenticated Access Control Vulnerabilities allow Information Disclosure in HPE Networking Fabric Composer API](https://agentprime.io/advisories/CVE-2026-73735.md) `CVE-2026-73735` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 5.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Local Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer](https://agentprime.io/advisories/CVE-2026-73732.md) `CVE-2026-73732` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 5.6 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Authenticated Arbitrary File Write leads to Remote Code Execution in HPE Networking Fabric Composer](https://agentprime.io/advisories/CVE-2026-73705.md) `CVE-2026-73705` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Unauthenticated Limited Information Disclosure allows Data Exposure in the API of HPE Networking Fabric Composer](https://agentprime.io/advisories/CVE-2026-73745.md) `CVE-2026-73745` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 3.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests](https://agentprime.io/advisories/GHSA-g47c-3xmw-q6m2.md) `GHSA-g47c-3xmw-q6m2`, `CVE-2026-73229`, `PYSEC-2026-3828` · PyPI `djangorestframework`: affected `<3.17.2`, fixed in `3.17.2` · CVSS 4.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml](https://agentprime.io/advisories/GHSA-vx52-2968-3vc6.md) `GHSA-vx52-2968-3vc6`, `CVE-2026-101043` · npm `pnpm`: affected `>=10.7.0, <10.34.5 || >=11.0.0, <11.11.0`, fixed in `10.34.5`, `11.11.0` · CVSS 8.3 High · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure, Weak cryptography or TLS, Hard-coded credentials - [Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path](https://agentprime.io/advisories/CVE-2026-83551.md) `CVE-2026-83551` · CVE record: AWS sagemaker-python-sdk · CVSS 8.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Kirby: System path exposure from error messages in the REST API](https://agentprime.io/advisories/GHSA-rf2p-vh74-7vvh.md) `GHSA-rf2p-vh74-7vvh`, `CVE-2026-69127`, `PKSA-wq8z-fxnn-1fxz` · Packagist `getkirby/cms`: affected `<4.9.5 || >=5.0.0, <5.5.2`, fixed in `4.9.5`, `5.5.2` · CVSS 6.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts](https://agentprime.io/advisories/CVE-2026-53682.md) `CVE-2026-53682` · CVE record: Red Hat Red Hat Certificate System 9 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure, Broken access control - [Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15](https://agentprime.io/advisories/CVE-2026-84143.md) `CVE-2026-84143` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Internally found bugs fixed in Thunderbird 155](https://agentprime.io/advisories/CVE-2026-84142.md) `CVE-2026-84142` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Other issue in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-84136.md) `CVE-2026-84136` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Other issue in Firefox Focus for Android](https://agentprime.io/advisories/CVE-2026-84135.md) `CVE-2026-84135` · CVE record: Mozilla Firefox · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Other issue in the Profile Backup component](https://agentprime.io/advisories/CVE-2026-84134.md) `CVE-2026-84134` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Information disclosure in the Networking: HTTP component](https://agentprime.io/advisories/CVE-2026-84132.md) `CVE-2026-84132` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Information disclosure in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-84130.md) `CVE-2026-84130` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Information disclosure in the WebExtensions component in Firefox for Android](https://agentprime.io/advisories/CVE-2026-84127.md) `CVE-2026-84127` · CVE record: Mozilla Firefox · CVSS 4.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure - [Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure](https://agentprime.io/advisories/CVE-2026-11873.md) `CVE-2026-11873` · CVE record: Red Hat Red Hat Certificate System 9 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .