# Information disclosure. Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Duplicate Advisory: vm2: util.getCallSites() bypasses GHSA-v27g host-frame redaction, leaks host call stack](https://agentprime.io/advisories/GHSA-2vh9-cv26-p97m.md) `GHSA-2vh9-cv26-p97m` · npm `vm2`: affected `<=3.11.7`, no fixed version yet · CVSS 5.8 Medium · Withdrawn · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [Vendure: Shop API list queries can return non-public entities when filterOperator is OR](https://agentprime.io/advisories/GHSA-xf65-r35x-wmmv.md) `GHSA-xf65-r35x-wmmv`, `CVE-2026-63461` · npm `@vendure/core`: affected `>=1.0.0, <3.6.5`, fixed in `3.6.5` · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [RMCP: Custom HTTP headers leak to cross-origin redirect targets](https://agentprime.io/advisories/GHSA-9g45-5xwm-f3wc.md) `GHSA-9g45-5xwm-f3wc`, `CVE-2026-64684` · crates.io `rmcp`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 6.8 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [Information disclosure in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others](https://agentprime.io/advisories/CVE-2026-80356.md) `CVE-2026-80356` · CVE record: Dell OpenManage Server Administrator Managed Node (Patch) for Windows and 4 more · CVSS 7.3 High · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [Actor record with password digest stored in AshAuthentication audit log entries](https://agentprime.io/advisories/GHSA-59wx-q3r8-ghv4.md) `GHSA-59wx-q3r8-ghv4`, `CVE-2026-82723`, `EEF-CVE-2026-82723` · Hex `ash_authentication`: affected `>=4.12.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.2`, fixed in `4.15.0`, `5.0.0-rc.2` · CVSS 1.8 Low · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [admin3 through 3.0.0 Session Token Disclosure via Audit Log](https://agentprime.io/advisories/CVE-2026-92918.md) `CVE-2026-92918` · CVE record: cjbi admin3 · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r](https://agentprime.io/advisories/CVE-2026-92917.md) `CVE-2026-92917` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork](https://agentprime.io/advisories/CVE-2026-92916.md) `CVE-2026-92916` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [WebSocket Exposure Vulnerability in NitroSense and PredatorSense Software](https://agentprime.io/advisories/CVE-2026-50607.md) `CVE-2026-50607` · CVE record: Acer System Monitoring · CVSS 2.7 Low · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [Service token exposure and potential privilege escalation in SUSE Observability](https://agentprime.io/advisories/CVE-2026-44940.md) `CVE-2026-44940` · CVE record: SUSE SUSE Observability · CVSS 5.7 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export](https://agentprime.io/advisories/CVE-2026-87836.md) `CVE-2026-87836` · CVE record: Unknown Comments Import & Export · CVSS 2.7 Low · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint](https://agentprime.io/advisories/CVE-2026-86446.md) `CVE-2026-86446` · CVE record: Unknown LearnPress · CVSS 3.7 Low · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client](https://agentprime.io/advisories/GHSA-pvg3-6q9j-mj3x.md) `GHSA-pvg3-6q9j-mj3x`, `CVE-2026-61588`, `PYSEC-2026-4045` · PyPI `djust`: affected `<1.0.7`, fixed in `1.0.7` · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL](https://agentprime.io/advisories/CVE-2026-92594.md) `CVE-2026-92594` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass](https://agentprime.io/advisories/CVE-2026-92811.md) `CVE-2026-92811` · CVE record: browserless browserless · CVSS 7.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter](https://agentprime.io/advisories/CVE-2026-92770.md) `CVE-2026-92770` · CVE record: goharbor harbor · CVSS 7.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Information Exposure & Insecure Handling](https://agentprime.io/advisories/CVE-2026-20360.md) `CVE-2026-20360` · CVE record: Cisco Cisco Nexus Dashboard · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [Tanium addressed an information disclosure vulnerability in Discover.](https://agentprime.io/advisories/CVE-2026-87076.md) `CVE-2026-87076` · CVE record: Tanium Discover · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [Under certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users.](https://agentprime.io/advisories/CVE-2026-73457.md) `CVE-2026-73457` · CVE record: Arista Networks EOS · CVSS 6.0 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privi…](https://agentprime.io/advisories/CVE-2026-73442.md) `CVE-2026-73442` · CVE record: Arista Networks EOS · CVSS 2.1 Low · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [Rallly before 4.15.0 Information Disclosure via polls.get](https://agentprime.io/advisories/CVE-2026-92565.md) `CVE-2026-92565` · CVE record: lukevella rallly · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG](https://agentprime.io/advisories/GHSA-8g2f-g3gq-5rjv.md) `GHSA-8g2f-g3gq-5rjv`, `CVE-2026-61590`, `PYSEC-2026-4039` · PyPI `djust`: affected `<1.0.7`, fixed in `1.0.7` · CVSS 7.4 High · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass, Information disclosure - [a2ui-project a2ui Model Processor model-processor.ts information disclosure](https://agentprime.io/advisories/CVE-2026-92357.md) `CVE-2026-92357` · CVE record: a2ui-project a2ui · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure, Broken access control - [Cleartext Storage of Sensitive Information Vulnerability](https://agentprime.io/advisories/CVE-2026-86443.md) `CVE-2026-86443` · CVE record: Fermax Electronica S.A.U. DuoxMe · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [Information Disclosure via Schema Path Manipulation](https://agentprime.io/advisories/CVE-2026-27553.md) `CVE-2026-27553` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes](https://agentprime.io/advisories/CVE-2026-87907.md) `CVE-2026-87907` · CVE record: Unknown Rox Appointment Booking · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route](https://agentprime.io/advisories/CVE-2026-87896.md) `CVE-2026-87896` · CVE record: Unknown Rox Appointment Booking · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass](https://agentprime.io/advisories/CVE-2026-87854.md) `CVE-2026-87854` · CVE record: Unknown Subscriptions for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API](https://agentprime.io/advisories/CVE-2026-86449.md) `CVE-2026-86449` · CVE record: Unknown LearnPress · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order](https://agentprime.io/advisories/CVE-2026-86448.md) `CVE-2026-86448` · CVE record: Unknown LearnPress · CVSS 3.7 Low · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax](https://agentprime.io/advisories/CVE-2026-86447.md) `CVE-2026-86447` · CVE record: Unknown LearnPress · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax](https://agentprime.io/advisories/CVE-2026-86445.md) `CVE-2026-86445` · CVE record: Unknown LearnPress · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure](https://agentprime.io/advisories/CVE-2026-85572.md) `CVE-2026-85572` · CVE record: Unknown Tutor LMS · CVSS 4.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [FluentBoards < 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDOR](https://agentprime.io/advisories/CVE-2026-85349.md) `CVE-2026-85349` · CVE record: Unknown FluentBoards · CVSS 4.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output](https://agentprime.io/advisories/CVE-2026-82124.md) `CVE-2026-82124` · CVE record: Unknown Schema & Structured Data for WP & AMP · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' Parameter](https://agentprime.io/advisories/CVE-2026-78474.md) `CVE-2026-78474` · CVE record: Unknown Ni WooCommerce Sales Report · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage.](https://agentprime.io/advisories/CVE-2025-56566.md) `CVE-2025-56566` · CVE record · CVSS 4.6 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure - [DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within non-volatile memory.](https://agentprime.io/advisories/CVE-2025-56565.md) `CVE-2025-56565` · CVE record · CVSS 7.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: Information disclosure, CWE-316 - [Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints](https://agentprime.io/advisories/CVE-2026-76855.md) `CVE-2026-76855` · CVE record: Netcore NR255-V · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-91725.md) `CVE-2026-91725` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-91714.md) `CVE-2026-91714` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [\`tts-be\` application has a Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-88065.md) `CVE-2026-88065` · CVE record: NIAEFEUP tts-be · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure, Authentication bypass, Broken access control - [Sensitive information in log files in Devolutions PowerShell Universal](https://agentprime.io/advisories/CVE-2026-92237.md) `CVE-2026-92237` · CVE record: Devolutions PowerShell Universal · CVSS 6.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87225.md) `CVE-2026-87225` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87221.md) `CVE-2026-87221` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87209.md) `CVE-2026-87209` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle Purchasing](https://agentprime.io/advisories/CVE-2026-87127.md) `CVE-2026-87127` · CVE record: Oracle Corporation Oracle Purchasing · CVSS 7.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle Assets](https://agentprime.io/advisories/CVE-2026-83443.md) `CVE-2026-83443` · CVE record: Oracle Corporation Oracle Assets · CVSS 6.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle Engineering](https://agentprime.io/advisories/CVE-2026-83437.md) `CVE-2026-83437` · CVE record: Oracle Corporation Oracle Engineering · CVSS 7.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle Complex Maintenance, Repair and Overhaul](https://agentprime.io/advisories/CVE-2026-83425.md) `CVE-2026-83425` · CVE record: Oracle Corporation Oracle Complex Maintenance, Repair and Overhaul · CVSS 8.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle JDeveloper](https://agentprime.io/advisories/CVE-2026-83424.md) `CVE-2026-83424` · CVE record: Oracle Corporation Oracle JDeveloper · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle Communications Cloud Native Core Security Edge…](https://agentprime.io/advisories/CVE-2026-83419.md) `CVE-2026-83419` · CVE record: Oracle Corporation Oracle Communications Cloud Native Core Security Edge Protection Proxy · CVSS 5.4 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle Communications Cloud Native Core Security Edge…](https://agentprime.io/advisories/CVE-2026-83417.md) `CVE-2026-83417` · CVE record: Oracle Corporation Oracle Communications Cloud Native Core Security Edge Protection Proxy · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle Coherence](https://agentprime.io/advisories/CVE-2026-83414.md) `CVE-2026-83414` · CVE record: Oracle Corporation Oracle Coherence · CVSS 2.5 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle Coherence](https://agentprime.io/advisories/CVE-2026-83354.md) `CVE-2026-83354` · CVE record: Oracle Corporation Oracle Coherence · CVSS 6.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle XML Gateway](https://agentprime.io/advisories/CVE-2026-83352.md) `CVE-2026-83352` · CVE record: Oracle Corporation Oracle XML Gateway · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Siebel CRM Integration](https://agentprime.io/advisories/CVE-2026-83326.md) `CVE-2026-83326` · CVE record: Oracle Corporation Siebel CRM Integration · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle BI Publisher](https://agentprime.io/advisories/CVE-2026-83302.md) `CVE-2026-83302` · CVE record: Oracle Corporation Oracle BI Publisher · CVSS 8.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle XML Gateway](https://agentprime.io/advisories/CVE-2026-83300.md) `CVE-2026-83300` · CVE record: Oracle Corporation Oracle XML Gateway · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Information disclosure in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-83287.md) `CVE-2026-83287` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 7.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .