# Information disclosure.

Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Thinkware U3000 TCP Service GET_STATUS information disclosure](https://agentprime.io/advisories/CVE-2026-101055.md)
  `CVE-2026-101055` · CVE record: Thinkware U3000 · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure, Broken access control
- [Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files](https://agentprime.io/advisories/CVE-2026-82385.md)
  `CVE-2026-82385` · CVE record: Apache Software Foundation Apache Roller · CVSS 6.5 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure
- [Eyeplus p2pcam Service snapshot information disclosure](https://agentprime.io/advisories/CVE-2026-100907.md)
  `CVE-2026-100907` · CVE record: Eyeplus · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure, Broken access control
- [Eyeplus ONVIF Device GetUsers information disclosure](https://agentprime.io/advisories/CVE-2026-100906.md)
  `CVE-2026-100906` · CVE record: Eyeplus · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure, Broken access control
- [Verge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_file](https://agentprime.io/advisories/CVE-2026-92995.md)
  `CVE-2026-92995` · CVE record: Unknown Verge3D Publishing and E-Commerce · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Information disclosure
- [UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice](https://agentprime.io/advisories/CVE-2026-82841.md)
  `CVE-2026-82841` · CVE record: Unknown UpdraftPlus: WP Backup & Migration Plugin · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Information disclosure
- [Duplicate Advisory: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary](https://agentprime.io/advisories/GHSA-43rv-jrfh-9mrr.md)
  `GHSA-43rv-jrfh-9mrr` · npm `vm2`: affected `<3.12.2`, fixed in `3.12.2` · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 27 Sept 2026 · Tags: Information disclosure
- [heym before 0.0.91 Multiple Secrets Plaintext Storage](https://agentprime.io/advisories/CVE-2026-100862.md)
  `CVE-2026-100862` · CVE record: heymrun heym · CVSS 6.9 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Information disclosure
- [AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile](https://agentprime.io/advisories/CVE-2026-100851.md)
  `CVE-2026-100851` · CVE record: AzuraCast AzuraCast · CVSS 7.2 High · Not analysed yet · Published 27 Sept 2026 · Tags: Information disclosure
- [Froxlor before 2.3.12 Credential Disclosure via DirProtections API](https://agentprime.io/advisories/CVE-2026-100719.md)
  `CVE-2026-100719` · CVE record: froxlor froxlor · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Froxlor before 2.3.12 DKIM Private Key Disclosure via API](https://agentprime.io/advisories/CVE-2026-100710.md)
  `CVE-2026-100710` · CVE record: froxlor froxlor · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Froxlor before 2.3.13 Private Key Disclosure via Certificates API](https://agentprime.io/advisories/CVE-2026-100708.md)
  `CVE-2026-100708` · CVE record: froxlor froxlor · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib](https://agentprime.io/advisories/CVE-2026-100703.md)
  `CVE-2026-100703` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast](https://agentprime.io/advisories/CVE-2026-100687.md)
  `CVE-2026-100687` · CVE record: budibase server · CVSS 7.0 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import](https://agentprime.io/advisories/CVE-2026-100680.md)
  `CVE-2026-100680` · CVE record: budibase server · CVSS 8.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [stoatchat before 0.15.5 Account Enumeration via Error Location](https://agentprime.io/advisories/CVE-2026-100677.md)
  `CVE-2026-100677` · CVE record: stoatchat stoatchat · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Grav before 2.0.25 Session Cookie Theft via Twig Sandbox](https://agentprime.io/advisories/CVE-2026-100671.md)
  `CVE-2026-100671` · CVE record: getgrav grav · CVSS 8.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Grav before 2.0.25 Sandbox Escape via array Filter](https://agentprime.io/advisories/CVE-2026-100668.md)
  `CVE-2026-100668` · CVE record: getgrav grav · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [SiYuan before v3.8.4 Clipboard Data Disclosure via IPC](https://agentprime.io/advisories/CVE-2026-100640.md)
  `CVE-2026-100640` · CVE record: siyuan-note siyuan · CVSS 8.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery](https://agentprime.io/advisories/CVE-2026-100632.md)
  `CVE-2026-100632` · CVE record: parse-community parse-server · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [capgo.app through 12.129.0 Cache Restoration of Deleted Bundles](https://agentprime.io/advisories/CVE-2026-100622.md)
  `CVE-2026-100622` · CVE record: Cap-go capgo.app · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route](https://agentprime.io/advisories/CVE-2026-96526.md)
  `CVE-2026-96526` · CVE record: Unknown MCP Server for WordPress · CVSS 2.7 Low · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure](https://agentprime.io/advisories/CVE-2026-19708.md)
  `CVE-2026-19708` · CVE record: Unknown File Manager · CVSS 5.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Team Showcase Supreme < 9.3 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details](https://agentprime.io/advisories/CVE-2026-11871.md)
  `CVE-2026-11871` · CVE record: Unknown Team Members · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [OpenClaw before 2026.7.1 Authorization Bypass via diagnostics](https://agentprime.io/advisories/CVE-2026-100595.md)
  `CVE-2026-100595` · CVE record: OpenClaw OpenClaw · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [OpenClaw before 2026.7.1 Authorization Bypass via trajectory export](https://agentprime.io/advisories/CVE-2026-100594.md)
  `CVE-2026-100594` · CVE record: OpenClaw OpenClaw · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension](https://agentprime.io/advisories/CVE-2026-100581.md)
  `CVE-2026-100581` · CVE record: OpenClaw OpenClaw · CVSS 6.8 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [OpenClaw before 2026.8.1 Unauthorized Command Job Access](https://agentprime.io/advisories/CVE-2026-100568.md)
  `CVE-2026-100568` · CVE record: OpenClaw OpenClaw · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback](https://agentprime.io/advisories/CVE-2026-100548.md)
  `CVE-2026-100548` · CVE record: OpenClaw OpenClaw · CVSS 6.0 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash](https://agentprime.io/advisories/CVE-2026-100543.md)
  `CVE-2026-100543` · CVE record: OpenClaw OpenClaw · CVSS 7.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [OpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint](https://agentprime.io/advisories/CVE-2026-100528.md)
  `CVE-2026-100528` · CVE record: OpenClaw OpenClaw · CVSS 5.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Flame through 2.4.0 Information Exposure via GET /api/config](https://agentprime.io/advisories/CVE-2026-100418.md)
  `CVE-2026-100418` · CVE record: pawelmalak flame · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure
- [Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata](https://agentprime.io/advisories/CVE-2026-63432.md)
  `CVE-2026-63432` · CVE record: horilla horilla-hr · CVSS 6.5 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Code injection, Information disclosure
- [Cross-request disclosure of CentralAuth cookies in Wikipedia Android App](https://agentprime.io/advisories/CVE-2026-100379.md)
  `CVE-2026-100379` · CVE record: Wikimedia Foundation Wikipedia Android App · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure
- [Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract](https://agentprime.io/advisories/CVE-2026-100377.md)
  `CVE-2026-100377` · CVE record: Wikimedia Foundation Mediawiki - WikiLambda Extension · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure
- [Cross-origin credential leak in HTTP stream wrapper redirects](https://agentprime.io/advisories/CVE-2026-91766.md)
  `CVE-2026-91766` · CVE record: PHP Group PHP · CVSS 5.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Hard-coded credentials
- [Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens](https://agentprime.io/advisories/CVE-2026-63208.md)
  `CVE-2026-63208` · CVE record: zammad zammad · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, CWE-116
- [Zammad: Missing rate limiting allows password brute-forcing during two-factor login](https://agentprime.io/advisories/CVE-2026-84461.md)
  `CVE-2026-84461` · CVE record: zammad zammad · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Authentication bypass, CWE-799
- [Zammad: Sensitive Information Exposure in Integration Administration API](https://agentprime.io/advisories/CVE-2026-63207.md)
  `CVE-2026-63207` · CVE record: zammad zammad · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Hard-coded credentials
- [Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data](https://agentprime.io/advisories/CVE-2026-84464.md)
  `CVE-2026-84464` · CVE record: zammad zammad · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Broken access control
- [Zammad: Cross-User Taskbar Item Access Control Vulnerability](https://agentprime.io/advisories/CVE-2026-56728.md)
  `CVE-2026-56728` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Broken access control
- [Zammad: Titles of knowledge base answers will be shown across all categories via the global search](https://agentprime.io/advisories/CVE-2026-56729.md)
  `CVE-2026-56729` · CVE record: zammad zammad · CVSS 2.1 Low · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Broken access control, CWE-280
- [RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status](https://agentprime.io/advisories/CVE-2026-67406.md)
  `CVE-2026-67406` · CVE record: rabbitmq rabbitmq-server · CVSS 4.6 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure
- [RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint](https://agentprime.io/advisories/CVE-2026-67410.md)
  `CVE-2026-67410` · CVE record: rabbitmq rabbitmq-server · CVSS 8.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure
- [RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login](https://agentprime.io/advisories/CVE-2026-67236.md)
  `CVE-2026-67236` · CVE record: rabbitmq rabbitmq-server · CVSS 8.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure
- [InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments](https://agentprime.io/advisories/CVE-2026-39372.md)
  `CVE-2026-39372` · CVE record: InvoicePlane InvoicePlane · CVSS 4.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure
- [Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSE](https://agentprime.io/advisories/CVE-2026-96812.md)
  `CVE-2026-96812` · CVE record: Google gVisor · CVSS 8.8 High · Not analysed yet · Published 25 Sept 2026 · Tags: Privilege escalation, Information disclosure
- [Incomplete property masking in the SANnav logging subsystem](https://agentprime.io/advisories/CVE-2026-85417.md)
  `CVE-2026-85417` · CVE record: Brocade SANnav · CVSS 6.4 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure
- [An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the…](https://agentprime.io/advisories/CVE-2026-52622.md)
  `CVE-2026-52622` · CVE record · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure
- [FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gate](https://agentprime.io/advisories/CVE-2026-84283.md)
  `CVE-2026-84283` · CVE record: FluteCode Secure Folder · CVSS 6.8 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure
- [Information exposure vulnerability in the job scheduling component of SANnav before 3.0.1a](https://agentprime.io/advisories/CVE-2026-14442.md)
  `CVE-2026-14442` · CVE record: Brocade SANnav · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure
- [Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1a](https://agentprime.io/advisories/CVE-2026-14443.md)
  `CVE-2026-14443` · CVE record: Brocade SANnav · CVSS 8.4 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure
- [Botslab G980H Dashcams Insertion of Sensitive Information into Log File](https://agentprime.io/advisories/CVE-2026-82716.md)
  `CVE-2026-82716` · CVE record: Botslab G980H · CVSS 5.1 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure
- [@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata](https://agentprime.io/advisories/GHSA-jmg2-rcxh-w8q3.md)
  `GHSA-jmg2-rcxh-w8q3`, `CVE-2026-61782` · npm `@rsdoctor/rspack-plugin`: affected `<1.5.16`, fixed in `1.5.16` · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure
- [Podman: Malformed Image can trick podman run into leaking host environment variables into the container](https://agentprime.io/advisories/GHSA-4hq8-gpf5-8p68.md)
  `GHSA-4hq8-gpf5-8p68`, `CVE-2026-57231`, `GO-2026-6594` · Go `github.com/containers/podman` and 5 more: affected `>=1.8.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure
- [Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.a](https://agentprime.io/advisories/CVE-2026-82372.md)
  `CVE-2026-82372` · CVE record: Brocade SANnav · CVSS 8.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure
- [Plaintext exposure of sensitive authentication data in SANnav discovery service log files](https://agentprime.io/advisories/CVE-2026-82371.md)
  `CVE-2026-82371` · CVE record: Brocade SANnav · CVSS 8.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure
- [Dozzle label filters do not restrict container event and statistics streams](https://agentprime.io/advisories/GHSA-xcw9-qmmf-vqxj.md)
  `GHSA-xcw9-qmmf-vqxj`, `CVE-2026-62286`, `GO-2026-6592` · Go `github.com/amir20/dozzle`: affected `<1.29.1-0.20260622172006-19c01e0fb491`, fixed in `1.29.1-0.20260622172006-19c01e0fb491` · CVSS 4.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, Broken access control
- [TREK: Public trip share link ignores the \`share_map\` permission server-side (client-enforced authorization → itinerary/location disclosure)](https://agentprime.io/advisories/CVE-2026-77320.md)
  `CVE-2026-77320` · CVE record: mauriceboe TREK · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, Broken access control, CWE-602
- [TREK MCP trip summary bypasses delegated OAuth read scopes](https://agentprime.io/advisories/CVE-2026-77321.md)
  `CVE-2026-77321` · CVE record: mauriceboe TREK · CVSS 4.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, Broken access control

Newest: <https://agentprime.io/advisories/tag/info-disclosure.md>
Older: <https://agentprime.io/advisories/tag/info-disclosure.md?cursor=WyIyMDI2LTA5LTI0VDE4OjA0OjA1Ljk0NzAwMFoiLCJDVkUtMjAyNi03NzMyMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=info-disclosure&cursor=WyIyMDI2LTA5LTI4VDE2OjQ1OjA3Ljc2NTAwMFoiLCJDVkUtMjAyNi0xMDEwODMiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/info-disclosure/?cursor=WyIyMDI2LTA5LTI4VDE2OjQ1OjA3Ljc2NTAwMFoiLCJDVkUtMjAyNi0xMDEwODMiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.