# Information disclosure. Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials](https://agentprime.io/advisories/CVE-2026-63645.md) `CVE-2026-63645` · CVE record: openobserve openobserve · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure - [authentik: Stored credentials are readable with view permission alone](https://agentprime.io/advisories/CVE-2026-94611.md) `CVE-2026-94611` · CVE record: goauthentik authentik · CVSS 8.1 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, Hard-coded credentials - [LaSuite Doc: Public Documents Enumeration](https://agentprime.io/advisories/CVE-2026-76907.md) `CVE-2026-76907` · CVE record: suitenumerique docs · CVSS 6.5 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, Broken access control - [BentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests](https://agentprime.io/advisories/CVE-2026-63630.md) `CVE-2026-63630` · CVE record: alam00000 bentopdf · CVSS 3.4 Low · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, Insecure deserialization - [REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration](https://agentprime.io/advisories/GHSA-4f5f-j737-pm58.md) `GHSA-4f5f-j737-pm58`, `CVE-2026-62998`, `PKSA-61tb-yjv2-q4wp` · Packagist `redaxo/source`: affected `<5.21.2`, fixed in `5.21.2` · CVSS 4.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, CWE-20 - [Multiple Vulnerabilities in IBM Concert Software](https://agentprime.io/advisories/CVE-2026-6544.md) `CVE-2026-6544` · CVE record: IBM Concert · CVSS 6.2 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure - [Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2026-16302.md) `CVE-2026-16302` · CVE record: brainstormforce Spectra Legacy – Gutenberg Blocks · CVSS 4.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure - [Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor](https://agentprime.io/advisories/CVE-2026-4638.md) `CVE-2026-4638` · CVE record: Paessler GmbH PRTG Network Monitor · CVSS 7.1 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure - [O2OA Cipher Connection CipherConnectionAction.java list information disclosure](https://agentprime.io/advisories/CVE-2026-97179.md) `CVE-2026-97179` · CVE record: O2OA · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, Broken access control - [ezGlobal｜GPM LIGHT - Sensitive Data Exposure](https://agentprime.io/advisories/CVE-2026-97181.md) `CVE-2026-97181` · CVE record: ezGlobal GPM LIGHT · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure - [Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter](https://agentprime.io/advisories/CVE-2026-93662.md) `CVE-2026-93662` · CVE record: Unknown Events Manager · CVSS 4.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure - [Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure](https://agentprime.io/advisories/CVE-2026-82850.md) `CVE-2026-82850` · CVE record: Unknown Masteriyo LMS · CVSS 4.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure - [SPON Communications IP Network Audio Device XC-9603 Configuration File Download sys_cfg.txt loadCfg information disclosure](https://agentprime.io/advisories/CVE-2026-96774.md) `CVE-2026-96774` · CVE record: SPON Communications IP Network Audio Device XC-9603 · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, Broken access control - [Intelliants Subrion CMS actions.json assign-owner information disclosure](https://agentprime.io/advisories/CVE-2026-96772.md) `CVE-2026-96772` · CVE record: Intelliants Subrion CMS · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, Broken access control - [An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper " src/lib/utils.ts](https://agentprime.io/advisories/CVE-2026-52001.md) `CVE-2026-52001` · CVE record · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure - [An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components](https://agentprime.io/advisories/CVE-2026-51995.md) `CVE-2026-51995` · CVE record · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure - [LB-Link BL-CPE600EU Configuration Backup Mifi_config.bin information disclosure](https://agentprime.io/advisories/CVE-2026-96606.md) `CVE-2026-96606` · CVE record: LB-Link BL-CPE600EU · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure, Broken access control - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-80423.md) `CVE-2026-80423` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Formie: Missing authorization on sent notification resend modal exposes submission PII](https://agentprime.io/advisories/GHSA-9rg8-2wvr-fgjh.md) `GHSA-9rg8-2wvr-fgjh`, `CVE-2026-76089`, `PKSA-4fhy-ttgn-65dd` · Packagist `verbb/formie`: affected `<2.2.23 || >=3.0.0, <3.1.31`, fixed in `2.2.23`, `3.1.31` · CVSS 7.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure, Broken access control - [RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords](https://agentprime.io/advisories/CVE-2026-67221.md) `CVE-2026-67221` · CVE record: rabbitmq rabbitmq-server · CVSS 5.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs](https://agentprime.io/advisories/CVE-2026-66068.md) `CVE-2026-66068` · CVE record: rabbitmq rabbitmq-server · CVSS 5.6 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership](https://agentprime.io/advisories/CVE-2026-84712.md) `CVE-2026-84712` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Klever-Go: /log controls global node logging](https://agentprime.io/advisories/GHSA-9v8p-frvj-2pcm.md) `GHSA-9v8p-frvj-2pcm`, `CVE-2026-86064`, `GO-2026-6583` · Go `github.com/klever-io/klever-go`: affected `<1.7.20`, fixed in `1.7.20` · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure, Authentication bypass - [sfturing hosp_order CommonUserServiceImpl.java cleartext storage](https://agentprime.io/advisories/CVE-2026-96549.md) `CVE-2026-96549` · CVE record: sfturing hosp_order · CVSS 4.8 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure, CWE-310 - [Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error m…](https://agentprime.io/advisories/CVE-2026-84499.md) `CVE-2026-84499` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 7.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0](https://agentprime.io/advisories/CVE-2026-90899.md) `CVE-2026-90899` · CVE record: joomshaper.com Easy Store extension for Joomla · CVSS 8.2 High · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure, Broken access control - [Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks](https://agentprime.io/advisories/CVE-2026-71463.md) `CVE-2026-71463` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 2.7 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler](https://agentprime.io/advisories/CVE-2026-71461.md) `CVE-2026-71461` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.7 and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [WordPress TrustedLogin Connector plugin <= 2.0.3 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-95600.md) `CVE-2026-95600` · CVE record: TrustedLogin TrustedLogin Connector · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Cinnamon's kotaemon contains improper authorization checks in multi‑user chat handlers](https://agentprime.io/advisories/CVE-2026-86867.md) `CVE-2026-86867` · CVE record: Cinnamon AI Kotaemon · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure, Broken access control - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-4921.md) `CVE-2026-4921` · CVE record: IBM Guardium Data Protection · CVSS 2.7 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Multiple Vulnerabilities in IBM Concert Software](https://agentprime.io/advisories/CVE-2026-3626.md) `CVE-2026-3626` · CVE record: IBM Concert · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Foxit PDF Editor/Reader Missing Authorization Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-91788.md) `CVE-2026-91788` · CVE record: Foxit Software Inc. Foxit PDF Editor and 1 more · CVSS 4.7 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page](https://agentprime.io/advisories/CVE-2026-93528.md) `CVE-2026-93528` · CVE record: Unknown NP Quote Request for WooCommerce · CVSS 3.7 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [WPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure via woosc_load](https://agentprime.io/advisories/CVE-2026-90985.md) `CVE-2026-90985` · CVE record: Unknown WPC Smart Compare for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints](https://agentprime.io/advisories/CVE-2026-89331.md) `CVE-2026-89331` · CVE record: Unknown FluentBoards · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure](https://agentprime.io/advisories/CVE-2026-88929.md) `CVE-2026-88929` · CVE record: Unknown Product Badge, Label, Countdown Timer for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API](https://agentprime.io/advisories/CVE-2026-86783.md) `CVE-2026-86783` · CVE record: Unknown Post Grid Gutenberg Blocks · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists](https://agentprime.io/advisories/CVE-2026-86603.md) `CVE-2026-86603` · CVE record: Unknown WP Recipe Maker · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview](https://agentprime.io/advisories/CVE-2026-86602.md) `CVE-2026-86602` · CVE record: Unknown WP Recipe Maker · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API](https://agentprime.io/advisories/CVE-2026-84741.md) `CVE-2026-84741` · CVE record: Unknown The Events Calendar · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure](https://agentprime.io/advisories/CVE-2026-84168.md) `CVE-2026-84168` · CVE record: Unknown Easy Hide Login · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint](https://agentprime.io/advisories/CVE-2026-84026.md) `CVE-2026-84026` · CVE record: Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Zportals < 6.4.2 - Subscriber+ User Email Disclosure](https://agentprime.io/advisories/CVE-2026-18365.md) `CVE-2026-18365` · CVE record: Unknown zportals · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Multiple Vulnerabilities in IBM Concert Software](https://agentprime.io/advisories/CVE-2026-15915.md) `CVE-2026-15915` · CVE record: IBM Concert · CVSS 6.2 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure - [lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses](https://agentprime.io/advisories/GHSA-hrmj-7rvj-4hg8.md) `GHSA-hrmj-7rvj-4hg8`, `CVE-2026-85709`, `PYSEC-2026-4063` · PyPI `lightrag-hku`: affected `<1.5.5`, fixed in `1.5.5` · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure - [Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode](https://agentprime.io/advisories/GHSA-jpvm-9frm-hjcq.md) `GHSA-jpvm-9frm-hjcq`, `CVE-2026-76805`, `GO-2026-6571` · Go `github.com/projectdiscovery/nuclei/v3`: affected `>=3.0.0, <3.10.0`, fixed in `3.10.0` · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure - [OpenBao Agent Writes Secrets to Stdout](https://agentprime.io/advisories/GHSA-444v-8vxr-p36h.md) `GHSA-444v-8vxr-p36h`, `BIT-openbao-2026-77285`, `CVE-2026-77285`, `GO-2026-6554` · Go `github.com/openbao/openbao`: affected `<0.0.0-20260714163218-90272575e5f5 || >=0.1.0, <=1.1.5`, fixed in `0.0.0-20260714163218-90272575e5f5` · CVSS 2.4 Low · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure - [MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions](https://agentprime.io/advisories/GHSA-g5xv-mhgm-v5f6.md) `GHSA-g5xv-mhgm-v5f6`, `CVE-2026-77250`, `PYSEC-2026-4094` · PyPI `mcp-atlassian`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 6.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure - [MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials](https://agentprime.io/advisories/GHSA-6cr4-ccf3-x7h4.md) `GHSA-6cr4-ccf3-x7h4`, `CVE-2026-77259`, `PYSEC-2026-4086` · PyPI `mcp-atlassian`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 7.7 High · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal, Information disclosure - [MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path](https://agentprime.io/advisories/GHSA-wv8v-v4c5-v75j.md) `GHSA-wv8v-v4c5-v75j`, `CVE-2026-77246`, `PYSEC-2026-4104` · PyPI `mcp-atlassian`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 7.4 High · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal, Information disclosure, CWE-441 - [wlc may disclose API tokens to project-configured URLs](https://agentprime.io/advisories/GHSA-3mqq-hv9c-85hc.md) `GHSA-3mqq-hv9c-85hc`, `CVE-2026-62364`, `PYSEC-2026-4180` · PyPI `wlc`: affected `<2.0.1`, fixed in `2.0.1` · CVSS 2.3 Low · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure, CWE-349 - [OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging](https://agentprime.io/advisories/CVE-2026-95815.md) `CVE-2026-95815` · CVE record: OpenClaw OpenClaw iOS · CVSS 7.2 High · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure - [Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE)](https://agentprime.io/advisories/CVE-2026-76717.md) `CVE-2026-76717` · CVE record: Hewlett Packard Enterprise (HPE) ALE · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure - [Unauthenticated Remote Unauthorized Access, Information Disclosure, and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)](https://agentprime.io/advisories/CVE-2026-76712.md) `CVE-2026-76712` · CVE record: Hewlett Packard Enterprise (HPE) ALE · CVSS 7.3 High · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure - [Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE)](https://agentprime.io/advisories/CVE-2026-76710.md) `CVE-2026-76710` · CVE record: Hewlett Packard Enterprise (HPE) ALE · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure - [Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one](https://agentprime.io/advisories/CVE-2026-86059.md) `CVE-2026-86059` · CVE record: Dokploy dokploy · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure, Broken access control - [Dark Reader: Ability to request icon-like bitmap data from certain local web servers](https://agentprime.io/advisories/CVE-2026-92706.md) `CVE-2026-92706` · CVE record: darkreader darkreader · CVSS 3.4 Low · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure, CWE-346 - [Twenty: Field-level read bypass](https://agentprime.io/advisories/CVE-2026-85055.md) `CVE-2026-85055` · CVE record: twentyhq twenty · CVSS 7.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure, Broken access control - [MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name](https://agentprime.io/advisories/CVE-2026-95703.md) `CVE-2026-95703` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure, CWE-20 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .