# Information disclosure.

Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links](https://agentprime.io/advisories/CVE-2026-104073.md)
  `CVE-2026-104073` · CVE record: netbox-community netbox · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS), Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106334.md)
  `CVE-2026-106334` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106256.md)
  `CVE-2026-106256` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106237.md)
  `CVE-2026-106237` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106220.md)
  `CVE-2026-106220` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106192.md)
  `CVE-2026-106192` · CVE record: Google Chrome · CVSS 4.6 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106254.md)
  `CVE-2026-106254` · CVE record: Google Chrome · CVSS 5.1 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-106210.md)
  `CVE-2026-106210` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106321.md)
  `CVE-2026-106321` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-106351.md)
  `CVE-2026-106351` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106330.md)
  `CVE-2026-106330` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106348.md)
  `CVE-2026-106348` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106360.md)
  `CVE-2026-106360` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-106336.md)
  `CVE-2026-106336` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106277.md)
  `CVE-2026-106277` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-106303.md)
  `CVE-2026-106303` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-106180.md)
  `CVE-2026-106180` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106392.md)
  `CVE-2026-106392` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106424.md)
  `CVE-2026-106424` · CVE record: Google Chrome · CVSS 4.0 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106342.md)
  `CVE-2026-106342` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Resource exposure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106354.md)
  `CVE-2026-106354` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106415.md)
  `CVE-2026-106415` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106242.md)
  `CVE-2026-106242` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106214.md)
  `CVE-2026-106214` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability](https://agentprime.io/advisories/CVE-2026-66666.md)
  `CVE-2026-66666` · CVE record: Automattic WordPress · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Payload vulnerable to API key disclosure through ordinary document reads](https://agentprime.io/advisories/GHSA-238x-w2j9-gwwr.md)
  `GHSA-238x-w2j9-gwwr`, `CVE-2026-105849` · npm `payload`: affected `>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 7.7 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure, Broken access control
- [Payload: Token refresh and password reset responses may expose restricted user fields](https://agentprime.io/advisories/GHSA-xgv3-crq2-6f69.md)
  `GHSA-xgv3-crq2-6f69`, `CVE-2026-105853` · npm `payload`: affected `>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Payload: Polymorphic join queries could disclose hidden fields](https://agentprime.io/advisories/GHSA-fpww-c55p-cjv6.md)
  `GHSA-fpww-c55p-cjv6`, `CVE-2026-105847` · npm `payload`: affected `>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure, Broken access control
- [Payload: Sort queries could expose protected field information](https://agentprime.io/advisories/GHSA-9g87-32v6-3c2r.md)
  `GHSA-9g87-32v6-3c2r`, `CVE-2026-105805` · npm `payload`: affected `<3.88.0 || >=4.0.0-canary.0, <4.0.0-canary.27`, fixed in `3.88.0`, `4.0.0-canary.27` · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure, Broken access control
- [Sensitive information in log files in Dell Container Storage Modules](https://agentprime.io/advisories/CVE-2026-63689.md)
  `CVE-2026-63689` · CVE record: Dell Container Storage Modules · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Sensitive information in log files in Dell Container Storage Modules](https://agentprime.io/advisories/CVE-2026-61411.md)
  `CVE-2026-61411` · CVE record: Dell Container Storage Modules · CVSS 7.7 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [WordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-104399.md)
  `CVE-2026-104399` · CVE record: StylemixThemes Motors · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.17 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-105071.md)
  `CVE-2026-105071` · CVE record: Royal Plugins SiteVault – Backup, Restore, Migration \&amp; Cloning · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-104385.md)
  `CVE-2026-104385` · CVE record: Adrian Tobey Groundhogg · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-102387.md)
  `CVE-2026-102387` · CVE record: XServer Xserver Migrator · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-42413.md)
  `CVE-2026-42413` · CVE record: DaftPlug Snapshotify \&#8211; All-in-One Backup \&amp; Restore \&amp; Migrate · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-41562.md)
  `CVE-2026-41562` · CVE record: norvisgabriel Norvis Backup · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-41561.md)
  `CVE-2026-41561` · CVE record: Adrian Lin Museder RestoreOne · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-41559.md)
  `CVE-2026-41559` · CVE record: Pluginjoy SafeSnap – Verified WordPress Backup \&amp; Restore · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [WordPress Mailjet Email Marketing plugin <= 6.2.3 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-39791.md)
  `CVE-2026-39791` · CVE record: Mailjet Mailjet Email Marketing · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-39729.md)
  `CVE-2026-39729` · CVE record: WisdmLabs Edwiser Bridge · CVSS 7.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images](https://agentprime.io/advisories/CVE-2026-86786.md)
  `CVE-2026-86786` · CVE record: Unknown Slider Pro · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-41563.md)
  `CVE-2026-41563` · CVE record: Dawer Drew Sitemovr · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [uptrace user_handler.go Login information exposure](https://agentprime.io/advisories/CVE-2026-105707.md)
  `CVE-2026-105707` · CVE record: uptrace · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Docling: \`enable_local_fetch\` is not enforced in HTML browser-rendering mode](https://agentprime.io/advisories/GHSA-q43m-vhcp-mhvm.md)
  `GHSA-q43m-vhcp-mhvm`, `CVE-2026-105750`, `PYSEC-2026-4196`, `PYSEC-2026-4215` · PyPI `docling` and 1 more: affected `>=2.82.0, <2.118.1`, fixed in `2.118.1` · CVSS 5.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure, Broken access control
- [vLLM: Harmony tool continuations drop \`cache_salt\` — restoring a cross-tenant prefix-cache membership oracle](https://agentprime.io/advisories/GHSA-935w-9g4m-p28p.md)
  `GHSA-935w-9g4m-p28p`, `CVE-2026-105752`, `PYSEC-2026-4308` · PyPI `vllm`: affected `<0.30.0`, fixed in `0.30.0` · CVSS 3.1 Low · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure, CWE-524
- [An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints](https://agentprime.io/advisories/CVE-2026-95153.md)
  `CVE-2026-95153` · CVE record · CVSS 4.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features](https://agentprime.io/advisories/GHSA-ph72-cqr5-qpp7.md)
  `GHSA-ph72-cqr5-qpp7`, `CVE-2026-105754`, `PYSEC-2026-4309` · PyPI `vllm`: affected `<0.30.0`, fixed in `0.30.0` · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Denial of service, Broken access control, Information disclosure, CWE-20
- [vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary](https://agentprime.io/advisories/GHSA-489w-w794-jq94.md)
  `GHSA-489w-w794-jq94`, `CVE-2026-100723` · npm `vm2`: affected `<3.12.2`, fixed in `3.12.2` · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Memory corruption
- [Snowflake drivers writes sensitive information to logs](https://agentprime.io/advisories/GHSA-qqj6-54q6-cxv6.md)
  `GHSA-qqj6-54q6-cxv6`, `CVE-2026-86597`, `GO-2026-6665`, `PYSEC-2026-4301` · Go `github.com/snowflakedb/gosnowflake` and 6 more: affected `<=1.19.1`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure
- [Multiple @opentelemetry/instrumentation-\* packages expose database username via unconditional db.user span attribute](https://agentprime.io/advisories/GHSA-qqmp-wf37-98f9.md)
  `GHSA-qqmp-wf37-98f9`, `CVE-2026-104872` · npm `@opentelemetry/instrumentation-cassandra-driver` and 7 more: affected `<0.66.0`, fixed in `0.66.0` · CVSS 5.8 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure
- [Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.\_\_await\_\_](https://agentprime.io/advisories/GHSA-v853-p72q-4cfw.md)
  `GHSA-v853-p72q-4cfw` · PyPI `quart`: affected `>=0.23.0, <0.23.1`, fixed in `0.23.1` · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure
- [vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack](https://agentprime.io/advisories/GHSA-r273-hxvj-fxhp.md)
  `GHSA-r273-hxvj-fxhp`, `CVE-2026-92933` · npm `vm2`: affected `<3.11.8`, fixed in `3.11.8` · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, CWE-693
- [vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting](https://agentprime.io/advisories/GHSA-x6m4-chr9-cg97.md)
  `GHSA-x6m4-chr9-cg97`, `CVE-2026-92936` · npm `vm2`: affected `>=3.11.0, <3.11.7`, fixed in `3.11.7` · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure
- [vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool](https://agentprime.io/advisories/GHSA-fcqc-726x-5wfc.md)
  `GHSA-fcqc-726x-5wfc`, `CVE-2026-92947` · npm `vm2`: affected `<3.11.7`, fixed in `3.11.7` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, CWE-653
- [Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docli...](https://agentprime.io/advisories/GHSA-h42j-9hcc-3cwc.md)
  `GHSA-h42j-9hcc-3cwc`, `CVE-2026-105746`, `PYSEC-2026-4193` · PyPI `docling`: affected `>=2.83.0, <2.131.0`, fixed in `2.131.0` · CVSS 2.2 Low · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, CWE-693
- [Files accessible to external parties in Atlassian Bamboo Data Center and others](https://agentprime.io/advisories/CVE-2026-21589.md)
  `CVE-2026-21589` · CVE record: Atlassian Bamboo Data Center and 4 more · CVSS 9.3 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure
- [Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control](https://agentprime.io/advisories/CVE-2026-102262.md)
  `CVE-2026-102262` · CVE record: Newell Brands DYMO ID · CVSS 7.0 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal, Information disclosure
- [Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope](https://agentprime.io/advisories/CVE-2026-105684.md)
  `CVE-2026-105684` · CVE record: penpot penpot · CVSS 4.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Broken access control
- [Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane](https://agentprime.io/advisories/CVE-2026-105639.md)
  `CVE-2026-105639` · CVE record: makeplane plane · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Authentication bypass, Broken access control

Newest: <https://agentprime.io/advisories/tag/info-disclosure.md>
Older: <https://agentprime.io/advisories/tag/info-disclosure.md?cursor=WyIyMDI2LTEwLTA1VDE4OjEwOjM1Ljc4NzAwMFoiLCJDVkUtMjAyNi0xMDU2MzkiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=info-disclosure&cursor=WyIyMDI2LTEwLTA2VDE5OjA2OjQxLjQzODAwMFoiLCJDVkUtMjAyNi03Njc0OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/info-disclosure/?cursor=WyIyMDI2LTEwLTA2VDE5OjA2OjQxLjQzODAwMFoiLCJDVkUtMjAyNi03Njc0OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.