# Information disclosure. Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [MISP Information Disclosure via Forged Upload Path](https://agentprime.io/advisories/CVE-2026-95693.md) `CVE-2026-95693` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal, Information disclosure - [dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy](https://agentprime.io/advisories/CVE-2026-95270.md) `CVE-2026-95270` · CVE record: dgtlmoon changedetection.io · CVSS 6.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure, CWE-208 - [Package URLs can be used to exfiltrate arbitrary INI file values and environment variables](https://agentprime.io/advisories/CVE-2026-63278.md) `CVE-2026-63278` · CVE record: The Document Foundation LibreOffice · CVSS 6.7 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure - [WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter](https://agentprime.io/advisories/CVE-2026-9004.md) `CVE-2026-9004` · CVE record: nofearinc WP-CRM System – Manage Clients and Projects · CVSS 4.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure - [Joplin: KaTeX \`trust:true\` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows](https://agentprime.io/advisories/CVE-2026-49449.md) `CVE-2026-49449` · CVE record: laurent22 joplin · CVSS 2.5 Low · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure, Hard-coded credentials, CWE-829 - [InvenTree: Plugin-settings GET endpoints are readable without authentication](https://agentprime.io/advisories/CVE-2026-61746.md) `CVE-2026-61746` · CVE record: inventree InvenTree · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure, Broken access control - [InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure](https://agentprime.io/advisories/CVE-2026-61749.md) `CVE-2026-61749` · CVE record: inventree InvenTree · CVSS 6.5 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure, Server-side request forgery (SSRF) - [Sensitive information in log files in Dell Command Powershell Provider (DCPP)](https://agentprime.io/advisories/CVE-2026-49810.md) `CVE-2026-49810` · CVE record: Dell Command Powershell Provider (DCPP) · CVSS 7.8 High · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure - [jshERP through 3.6 Password Hash Disclosure via /user/info](https://agentprime.io/advisories/CVE-2026-94413.md) `CVE-2026-94413` · CVE record: jishenghua jshERP · CVSS 7.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure - [ntopng: Missing Authorization on System Configuration Backup Download and Listing](https://agentprime.io/advisories/CVE-2026-84990.md) `CVE-2026-84990` · CVE record: ntop ntopng · CVSS 8.8 High · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure, Broken access control - [Apache Airflow's \`/assets/events\` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user hol...](https://agentprime.io/advisories/PYSEC-2026-3988.md) `PYSEC-2026-3988`, `BIT-airflow-2026-75158`, `CVE-2026-75158` · PyPI `apache-airflow`: affected `<3.3.2`, fixed in `3.3.2` · CVSS 4.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure - [GoCD is vulnerable to credential exposure when admins insecurely configure material URLs](https://agentprime.io/advisories/CVE-2026-55870.md) `CVE-2026-55870` · CVE record: gocd gocd · CVSS 2.3 Low · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure, Hard-coded credentials - [ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure](https://agentprime.io/advisories/CVE-2026-94148.md) `CVE-2026-94148` · CVE record: ScadaBR · CVSS 6.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure, Broken access control - [nvm alias resolution follows \`..\` and discloses files outside $NVM_DIR/alias](https://agentprime.io/advisories/CVE-2026-94185.md) `CVE-2026-94185` · CVE record: nvm-sh nvm · CVSS 6.7 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Path traversal, Information disclosure - [CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information.](https://agentprime.io/advisories/CVE-2026-88467.md) `CVE-2026-88467` · CVE record · CVSS 6.2 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure - [Stencil core 4.43.5 is vulnerable to Incorrect Access Control.](https://agentprime.io/advisories/CVE-2026-79319.md) `CVE-2026-79319` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure - [An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive information via the PerformCommissioningStep function in the…](https://agentprime.io/advisories/CVE-2026-78806.md) `CVE-2026-78806` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure - [D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosure](https://agentprime.io/advisories/CVE-2026-94050.md) `CVE-2026-94050` · CVE record: D-Link DIR-X1860Z · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Information disclosure, Broken access control - [aiyiyi121 SxDevOps settings.py information disclosure](https://agentprime.io/advisories/CVE-2026-93971.md) `CVE-2026-93971` · CVE record: aiyiyi121 SxDevOps · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Information disclosure, Broken access control - [Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts](https://agentprime.io/advisories/CVE-2026-92423.md) `CVE-2026-92423` · CVE record: Unknown Meow Gallery · CVSS 2.7 Low · Not analysed yet · Published 20 Sept 2026 · Tags: Information disclosure - [Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) product](https://agentprime.io/advisories/CVE-2026-86551.md) `CVE-2026-86551` · CVE record: ZTE NX741J · CVSS 3.3 Low · Not analysed yet · Published 20 Sept 2026 · Tags: Information disclosure - [OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext](https://agentprime.io/advisories/CVE-2026-93982.md) `CVE-2026-93982` · CVE record: Openpanel-dev openpanel · CVSS 4.8 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Information disclosure - [WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints](https://agentprime.io/advisories/CVE-2026-9289.md) `CVE-2026-9289` · CVE record: wordlift WordLift – AI powered SEO – Schema · CVSS 5.3 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Information disclosure - [YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action](https://agentprime.io/advisories/CVE-2026-1255.md) `CVE-2026-1255` · CVE record: ysinnovations YS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins & Subscribers · CVSS 7.5 High · Not analysed yet · Published 19 Sept 2026 · Tags: Information disclosure - [MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure](https://agentprime.io/advisories/CVE-2026-92404.md) `CVE-2026-92404` · CVE record: Unknown MgoSync · CVSS 7.5 High · Not analysed yet · Published 19 Sept 2026 · Tags: Information disclosure - [Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins](https://agentprime.io/advisories/CVE-2026-16557.md) `CVE-2026-16557` · CVE record: Unknown Nimble Page Builder · CVSS 4.3 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Information disclosure - [Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storage](https://agentprime.io/advisories/CVE-2026-77875.md) `CVE-2026-77875` · CVE record: QUANTUMTECH LTD Hide Photos - Secure vault · CVSS 6.8 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure - [CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users](https://agentprime.io/advisories/CVE-2026-63646.md) `CVE-2026-63646` · CVE record: 1Panel-dev CordysCRM · CVSS 6.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure - [AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets](https://agentprime.io/advisories/GHSA-w72w-9qmj-c9qm.md) `GHSA-w72w-9qmj-c9qm`, `CVE-2026-63406`, `GO-2026-6529` · Go `github.com/anycable/anycable`: affected `<1.6.15`, fixed in `1.6.15` · CVSS 5.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure, Hard-coded credentials - [Silent plaintext persistence via unresolved callable database name in encryption schema map](https://agentprime.io/advisories/CVE-2026-93763.md) `CVE-2026-93763` · CVE record: MongoDB Inc. Mongoid · CVSS 7.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure - [Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation](https://agentprime.io/advisories/CVE-2026-93764.md) `CVE-2026-93764` · CVE record: MongoDB Inc. Mongoid · CVSS 7.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure - [CareCam CM2507 Cleartext Storage of Sensitive Information](https://agentprime.io/advisories/CVE-2026-81321.md) `CVE-2026-81321` · CVE record: CareCam HMT.CM2507 Firmware · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure - [Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent](https://agentprime.io/advisories/CVE-2026-1030.md) `CVE-2026-1030` · CVE record: IBM Common Licensing · CVSS 4.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure - [IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.](https://agentprime.io/advisories/CVE-2025-33141.md) `CVE-2025-33141` · CVE record: IBM QRadar · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure - [Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)](https://agentprime.io/advisories/CVE-2026-93685.md) `CVE-2026-93685` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 · CVSS 5.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure - [Multiple vulnerabilities in IBM Controller](https://agentprime.io/advisories/CVE-2025-1350.md) `CVE-2025-1350` · CVE record: IBM Controller · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure - [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-56597.md) `CVE-2026-56597` · CVE record: HCL Software HCL BigFix Service Management · CVSS 3.1 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure - [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67100.md) `CVE-2026-67100` · CVE record: HCL Software HCL BigFix Service Management · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection, Information disclosure - [GPTranslate <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script](https://agentprime.io/advisories/CVE-2026-89278.md) `CVE-2026-89278` · CVE record: john-dagelmore GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure - [Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure](https://agentprime.io/advisories/CVE-2026-89008.md) `CVE-2026-89008` · CVE record: Unknown Bookit — Booking & Appointment Calendar · CVSS 2.7 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure - [King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode](https://agentprime.io/advisories/CVE-2026-84903.md) `CVE-2026-84903` · CVE record: Unknown King Addons for Elementor · CVSS 2.7 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure - [NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read.](https://agentprime.io/advisories/CVE-2026-88623.md) `CVE-2026-88623` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-93385.md) `CVE-2026-93385` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-93383.md) `CVE-2026-93383` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs](https://agentprime.io/advisories/GHSA-8wmf-6v46-5gfg.md) `GHSA-8wmf-6v46-5gfg`, `CVE-2026-81870`, `GO-2026-6505` · Go `go.opentelemetry.io/otel/exporters/otlp/otlptrace` and 4 more: affected `>=1.5.0, <1.45.0`, fixed in `1.45.0` · CVSS 2.0 Low · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [Jupyter Server: 5xx request logging leaks token-bearing Referer header values](https://agentprime.io/advisories/GHSA-c3mw-737p-c7g2.md) `GHSA-c3mw-737p-c7g2`, `CVE-2026-86049`, `PYSEC-2026-4054` · PyPI `jupyter-server`: affected `<2.21.0`, fixed in `2.21.0` · CVSS 7.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths](https://agentprime.io/advisories/GHSA-p597-crqc-m349.md) `GHSA-p597-crqc-m349`, `CVE-2026-72698`, `PKSA-wz98-fgrh-3wq2` · Packagist `getgrav/grav`: affected `<2.0.16`, fixed in `2.0.16` · CVSS 7.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages](https://agentprime.io/advisories/CVE-2026-54565.md) `CVE-2026-54565` · CVE record: edwardkim rhwp · CVSS 4.7 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure, Server-side request forgery (SSRF), CWE-1385 - [Logs may collect sensitive information](https://agentprime.io/advisories/CVE-2026-92758.md) `CVE-2026-92758` · CVE record: MongoDB Inc. MongoDB Entity Framework Core Provider · CVSS 5.7 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To](https://agentprime.io/advisories/CVE-2026-54649.md) `CVE-2026-54649` · CVE record: PunchIn-App punchin-email · CVSS 2.1 Low · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets](https://agentprime.io/advisories/GHSA-8phw-xrj9-cpqp.md) `GHSA-8phw-xrj9-cpqp`, `CVE-2026-75523` · NuGet `Steeltoe.Management.Endpoint`: affected `<4.3.0`, fixed in `4.3.0` · CVSS 5.9 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [SourceCodester Drug Recommendation System drug_recommendor.sql information disclosure](https://agentprime.io/advisories/CVE-2026-92927.md) `CVE-2026-92927` · CVE record: SourceCodester Drug Recommendation System · CVSS 6.9 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure, Broken access control - [AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target](https://agentprime.io/advisories/GHSA-f8m2-889x-vw4x.md) `GHSA-f8m2-889x-vw4x`, `CVE-2026-85717` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.9, <3.0.12 || >=2.14.5, <2.16.1`, fixed in `3.0.12`, `2.16.1` · CVSS 6.8 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure, Hard-coded credentials - [Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure](https://agentprime.io/advisories/GHSA-7pgq-cr25-xvc8.md) `GHSA-7pgq-cr25-xvc8`, `CVE-2026-69088`, `PKSA-pr7b-2t3z-v8y8` · Packagist `getgrav/grav`: affected `>=2.0.7, <2.0.11`, fixed in `2.0.11` · CVSS 8.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: Code injection, Information disclosure - [mport package installation can overwrite existing unmanaged or differently owned files](https://agentprime.io/advisories/CVE-2026-54582.md) `CVE-2026-54582` · CVE record: MidnightBSD mport · CVSS 6.0 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Information disclosure - [RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution](https://agentprime.io/advisories/GHSA-hp3v-5vw7-fx9w.md) `GHSA-hp3v-5vw7-fx9w`, `CVE-2026-76825`, `PYSEC-2026-4161` · PyPI `restrictedpython`: affected `<8.4`, fixed in `8.4` · CVSS 8.4 High · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure, Code injection, Memory corruption, CWE-693 - [Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion](https://agentprime.io/advisories/GHSA-wr57-hqmp-fgvh.md) `GHSA-wr57-hqmp-fgvh`, `CVE-2026-69197` · NuGet `Umbraco.Cms`: affected `>=12.0.0, <13.15.1 || >=14.0.0-rc1, <17.5.3 || >=18.0.0, <18.0.2`, fixed in `13.15.1`, `17.5.3`, `18.0.2` · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure, Broken access control - [Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool](https://agentprime.io/advisories/GHSA-x5qg-8pq6-39h6.md) `GHSA-x5qg-8pq6-39h6` · npm `vm2`: affected `<=3.11.6`, no fixed version yet · CVSS 10.0 Critical · Withdrawn · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [Duplicate Advisory: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting](https://agentprime.io/advisories/GHSA-63m2-qqch-jxv2.md) `GHSA-63m2-qqch-jxv2` · npm `vm2`: affected `>=3.11.0, <=3.11.6`, no fixed version yet · CVSS 5.8 Medium · Withdrawn · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure - [Duplicate Advisory: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent](https://agentprime.io/advisories/GHSA-5843-9mh5-hhgw.md) `GHSA-5843-9mh5-hhgw` · npm `vm2`: affected `>=3.11.3, <=3.11.6`, no fixed version yet · CVSS 10.0 Critical · Withdrawn · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .