# Information disclosure.

Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Exposure of personal information in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-28938.md)
  `CVE-2026-28938` · CVE record: Apple iOS and iPadOS · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Information disclosure
- [Information disclosure in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-84583.md)
  `CVE-2026-84583` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Information disclosure
- [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-84576.md)
  `CVE-2026-84576` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Information disclosure
- [cosmicstack-labs mercury-agent Shell Permission Manifest permissions.ts PermissionManager.checkShellCommand information disclosure](https://agentprime.io/advisories/CVE-2026-90811.md)
  `CVE-2026-90811` · CVE record: cosmicstack-labs mercury-agent · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Information disclosure, Broken access control
- [Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure](https://agentprime.io/advisories/CVE-2026-77884.md)
  `CVE-2026-77884` · CVE record: Brain Trust Gallery - Private Photo Vault · CVSS 7.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: Information disclosure
- [Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs](https://agentprime.io/advisories/CVE-2026-82434.md)
  `CVE-2026-82434` · CVE record: Apache Software Foundation Apache Storm Nimbus and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Hard-coded credentials, Information disclosure
- [Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page](https://agentprime.io/advisories/CVE-2026-84179.md)
  `CVE-2026-84179` · CVE record: Apache Software Foundation Apache Storm Nimbus and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Information disclosure, Hard-coded credentials
- [Apache Syncope: JWT Access Token takeover](https://agentprime.io/advisories/CVE-2026-73178.md)
  `CVE-2026-73178` · CVE record: Apache Software Foundation Apache Syncope · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Information disclosure
- [Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user](https://agentprime.io/advisories/CVE-2026-78336.md)
  `CVE-2026-78336` · CVE record: Apache Software Foundation Apache Syncope · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Information disclosure
- [Apache Syncope: AES Secret Key disclosure via log output](https://agentprime.io/advisories/CVE-2026-87779.md)
  `CVE-2026-87779` · CVE record: Apache Software Foundation Apache Syncope · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Information disclosure
- [MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection](https://agentprime.io/advisories/CVE-2026-90895.md)
  `CVE-2026-90895` · CVE record: MISP MISP · CVSS 8.4 High · Not analysed yet · Published 14 Sept 2026 · Tags: Information disclosure, Hard-coded credentials, Broken access control, CWE-150
- [Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content Templater (Pro) < 14.2.0, ReReplacer (P…](https://agentprime.io/advisories/CVE-2026-85188.md)
  `CVE-2026-85188` · CVE record: regularlabs.com Advanced Module Manager (Free, Pro) extension for Joomla and 3 more · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Information disclosure
- [Chengdu Qilu Technology Ludashi ComputerZ_x64.sys sub_11008 information disclosure](https://agentprime.io/advisories/CVE-2026-90503.md)
  `CVE-2026-90503` · CVE record: Chengdu Qilu Technology Ludashi · CVSS 4.6 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Information disclosure, Broken access control
- [Bookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availability Check](https://agentprime.io/advisories/CVE-2026-88995.md)
  `CVE-2026-88995` · CVE record: Unknown Bookit — Booking & Appointment Calendar · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Information disclosure
- [User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page](https://agentprime.io/advisories/CVE-2026-86407.md)
  `CVE-2026-86407` · CVE record: Unknown User Registration & Membership · CVSS 3.7 Low · Not analysed yet · Published 13 Sept 2026 · Tags: Information disclosure
- [Social Contact Form (FormyChat) < 2.15.8 - Unauthenticated Gravity Forms Entry Disclosure via formychat_get_gf_entry](https://agentprime.io/advisories/CVE-2026-77773.md)
  `CVE-2026-77773` · CVE record: Unknown Contact Form to Chat Apps | Click to Chat to Order · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Information disclosure
- [WWBN AVideo Missing Authorization via mediaSession.json.php](https://agentprime.io/advisories/CVE-2026-90550.md)
  `CVE-2026-90550` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure
- [WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint](https://agentprime.io/advisories/CVE-2026-90549.md)
  `CVE-2026-90549` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure
- [WWBN AVideo Missing Authorization in ImageGallery list.json.php](https://agentprime.io/advisories/CVE-2026-90548.md)
  `CVE-2026-90548` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure
- [WWBN AVideo Unauthenticated Information Disclosure via menus.json.php](https://agentprime.io/advisories/CVE-2026-90541.md)
  `CVE-2026-90541` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure
- [WWBN AVideo Missing Authentication via menuItems.json.php](https://agentprime.io/advisories/CVE-2026-90539.md)
  `CVE-2026-90539` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure
- [WWBN AVideo Missing Authorization via playlistsFromUser.json.php](https://agentprime.io/advisories/CVE-2026-90538.md)
  `CVE-2026-90538` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure
- [WWBN AVideo Missing Authorization via adsInfo API Endpoint](https://agentprime.io/advisories/CVE-2026-90536.md)
  `CVE-2026-90536` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure
- [Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter](https://agentprime.io/advisories/CVE-2026-17585.md)
  `CVE-2026-17585` · CVE record: wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure
- [WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure](https://agentprime.io/advisories/CVE-2026-87916.md)
  `CVE-2026-87916` · CVE record: Unknown WPBot · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure
- [Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure](https://agentprime.io/advisories/CVE-2026-87842.md)
  `CVE-2026-87842` · CVE record: Unknown Zonify · CVSS 7.5 High · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure
- [Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download](https://agentprime.io/advisories/CVE-2026-80494.md)
  `CVE-2026-80494` · CVE record: Unknown Yogeta WP Cloud · CVSS 8.6 High · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure
- [SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema](https://agentprime.io/advisories/CVE-2026-78152.md)
  `CVE-2026-78152` · CVE record: Unknown SureRank SEO · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure
- [Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state](https://agentprime.io/advisories/CVE-2026-50025.md)
  `CVE-2026-50025` · CVE record: t-mart mousehole · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Information disclosure, Authentication bypass, Cross-site request forgery (CSRF), Broken access control
- [nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default](https://agentprime.io/advisories/CVE-2026-49462.md)
  `CVE-2026-49462` · CVE record: nl-portal nl.nl-portal:app · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Information disclosure, CWE-1188
- [Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration](https://agentprime.io/advisories/CVE-2026-89332.md)
  `CVE-2026-89332` · CVE record: AWS Kiro IDE · CVSS 6.7 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Information disclosure, CWE-829
- [WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-62088.md)
  `CVE-2026-62088` · CVE record: 10up ElasticPress · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Information disclosure
- [ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere](https://agentprime.io/advisories/CVE-2026-38058.md)
  `CVE-2026-38058` · CVE record: ST Engineering iDirect Evolution iQ‑Series terminals and 2 more · CVSS 8.6 High · Not analysed yet · Published 11 Sept 2026 · Tags: Information disclosure
- [Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get](https://agentprime.io/advisories/CVE-2026-89298.md)
  `CVE-2026-89298` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Information disclosure
- [AVideo WebRTC Plugin Information Disclosure via status.json.php](https://agentprime.io/advisories/CVE-2026-89248.md)
  `CVE-2026-89248` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Information disclosure
- [Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure](https://agentprime.io/advisories/CVE-2026-14562.md)
  `CVE-2026-14562` · CVE record: Unknown teddy-bear-customize-addon · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Information disclosure
- [rclone: http backend forwards custom/auth headers to a different host on redirect](https://agentprime.io/advisories/GHSA-486v-q2wf-fp2r.md)
  `GHSA-486v-q2wf-fp2r`, `BIT-rclone-2026-88013`, `CVE-2026-88013`, `GO-2026-6463` · Go `github.com/rclone/rclone`: affected `>=1.49.0, <1.75.1`, fixed in `1.75.1` · CVSS 3.7 Low · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure, Weak cryptography or TLS, Hard-coded credentials
- [Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication](https://agentprime.io/advisories/GHSA-p78m-89r6-pgf7.md)
  `GHSA-p78m-89r6-pgf7`, `CVE-2026-87015`, `PYSEC-2026-4124` · PyPI `open-webui`: affected `>=0.6.27, <0.11.1`, fixed in `0.11.1` · CVSS 6.8 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure
- [Angular: Information Leak via \`HttpTransferCache\` Bypass When Using \`withRequestsMadeViaParent\`](https://agentprime.io/advisories/GHSA-p297-fm68-3q8c.md)
  `GHSA-p297-fm68-3q8c`, `CVE-2026-88059` · npm `@angular/common`: affected `<=19.2.25 || >=20.0.0, <20.3.28 || >=21.0.0, <21.2.20 || >=22.0.0, <22.1.1`, fixed in `20.3.28`, `21.2.20`, `22.1.1` · CVSS 4.0 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure, CWE-524
- [Consul-template vulnerable to an information disclosure issue in error handling](https://agentprime.io/advisories/CVE-2026-87993.md)
  `CVE-2026-87993` · CVE record: HashiCorp Tooling · CVSS 7.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure
- [Storage of Sensitive Information in Cleartext in NI SystemLink](https://agentprime.io/advisories/CVE-2026-4130.md)
  `CVE-2026-4130` · CVE record: NI SystemLink and 1 more · CVSS 8.4 High · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure
- [Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends](https://agentprime.io/advisories/GHSA-pcvc-8vrv-8q6w.md)
  `GHSA-pcvc-8vrv-8q6w`, `CVE-2026-87017`, `PYSEC-2026-4125` · PyPI `open-webui`: affected `>=0.7.0, <0.11.1`, fixed in `0.11.1` · CVSS 4.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure, Broken access control
- [WordPress ZHBackup – Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-81804.md)
  `CVE-2026-81804` · CVE record: Zain Hassan ZHBackup – Backup, Restore \&amp; Migration · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure
- [OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure](https://agentprime.io/advisories/CVE-2026-88893.md)
  `CVE-2026-88893` · CVE record: Openpanel-dev openpanel · CVSS 8.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure
- [Renovate before 44.14.4 TLS Private Key Log Sanitisation](https://agentprime.io/advisories/CVE-2026-88883.md)
  `CVE-2026-88883` · CVE record: renovatebot renovate and 4 more · CVSS 8.3 High · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure
- [AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD](https://agentprime.io/advisories/CVE-2026-88876.md)
  `CVE-2026-88876` · CVE record: WWBN AVideo · CVSS 8.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure
- [AVideo Incomplete API Sanitization Information Disclosure](https://agentprime.io/advisories/CVE-2026-88875.md)
  `CVE-2026-88875` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure
- [AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass](https://agentprime.io/advisories/CVE-2026-88874.md)
  `CVE-2026-88874` · CVE record: WWBN AVideo · CVSS 8.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure
- [Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0](https://agentprime.io/advisories/CVE-2026-78374.md)
  `CVE-2026-78374` · CVE record: joomlart.com T4 Page Builder extension for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure
- [Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4](https://agentprime.io/advisories/CVE-2026-78303.md)
  `CVE-2026-78303` · CVE record: joomshaper.com SP Property extension for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure
- [Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details](https://agentprime.io/advisories/CVE-2026-19439.md)
  `CVE-2026-19439` · CVE record: Unknown Ultimate Gift Cards for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure
- [Prisma Access Agent: Information Disclosure Vulnerability on Linux](https://agentprime.io/advisories/CVE-2026-0305.md)
  `CVE-2026-0305` · CVE record: Palo Alto Networks Prisma Access Agent · CVSS 4.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Information disclosure
- [SQLAdmin: Unvalidated sortBy parameter in \`ModelView\` bypasses \`column_sortable_list\`](https://agentprime.io/advisories/GHSA-ccg5-9c8w-xh6v.md)
  `GHSA-ccg5-9c8w-xh6v`, `CVE-2026-54529`, `PYSEC-2026-3922` · PyPI `sqladmin`: affected `<0.27.1`, fixed in `0.27.1` · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Information disclosure, Broken access control, CWE-20, CWE-248
- [Snipe-IT before 8.7.0 Cross-Company Read via requested-assets](https://agentprime.io/advisories/CVE-2026-86767.md)
  `CVE-2026-86767` · CVE record: grokability snipe-it · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Information disclosure
- [CWE-532: Insertion of Sensitive Information into Log File](https://agentprime.io/advisories/CVE-2026-79966.md)
  `CVE-2026-79966` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 3.3 Low · Not analysed yet · Published 9 Sept 2026 · Tags: Information disclosure
- [Sensitive information in log files in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-80169.md)
  `CVE-2026-80169` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 3.3 Low · Not analysed yet · Published 9 Sept 2026 · Tags: Information disclosure
- [CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner](https://agentprime.io/advisories/CVE-2026-87820.md)
  `CVE-2026-87820` · CVE record: usmannasir cyberpanel · CVSS 6.9 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Information disclosure
- [Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock](https://agentprime.io/advisories/CVE-2026-87810.md)
  `CVE-2026-87810` · CVE record: siyuan-note siyuan · CVSS 6.9 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Information disclosure
- [Sensitive information is leaked into NeuVector’s manager container logs](https://agentprime.io/advisories/CVE-2025-46808.md)
  `CVE-2025-46808` · CVE record: SUSE neuvector · CVSS 6.8 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Information disclosure
- [Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Externally-Accessible File or Direct…](https://agentprime.io/advisories/CVE-2026-80175.md)
  `CVE-2026-80175` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 3.3 Low · Not analysed yet · Published 9 Sept 2026 · Tags: Information disclosure

Newest: <https://agentprime.io/advisories/tag/info-disclosure.md>
Older: <https://agentprime.io/advisories/tag/info-disclosure.md?cursor=WyIyMDI2LTA5LTA5VDA4OjE0OjI3LjczODAwMFoiLCJDVkUtMjAyNi04MDE3NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=info-disclosure&cursor=WyIyMDI2LTA5LTE0VDIwOjQ3OjU2LjczMTAwMFoiLCJDVkUtMjAyNi04Njg3OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/info-disclosure/?cursor=WyIyMDI2LTA5LTE0VDIwOjQ3OjU2LjczMTAwMFoiLCJDVkUtMjAyNi04Njg3OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.