# Information disclosure.

Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Mechanize sends credential headers to another origin after a meta refresh](https://agentprime.io/advisories/GHSA-c6rp-p8xm-4q9f.md)
  `GHSA-c6rp-p8xm-4q9f`, `CVE-2026-107399` · RubyGems `mechanize`: affected `<2.14.1`, fixed in `2.14.1` · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Hard-coded credentials
- [Mechanize sends credential headers to another host after an HTTP redirect](https://agentprime.io/advisories/GHSA-2mwr-xjcg-37j7.md)
  `GHSA-2mwr-xjcg-37j7`, `CVE-2026-107715` · RubyGems `mechanize`: affected `<2.14.1`, fixed in `2.14.1` · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Hard-coded credentials
- [PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure](https://agentprime.io/advisories/GHSA-6wjp-v33h-5cvq.md)
  `GHSA-6wjp-v33h-5cvq`, `CVE-2026-61426` · npm `praisonai`: affected `<1.7.3`, fixed in `1.7.3` · CVSS 8.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Broken access control, Authentication bypass
- [PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF](https://agentprime.io/advisories/GHSA-4w49-gwv8-fpjg.md)
  `GHSA-4w49-gwv8-fpjg`, `CVE-2026-60091`, `PYSEC-2026-4249` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Authentication bypass, Race condition, Server-side request forgery (SSRF)
- [Mechanize sends credential headers to a different scheme or port after a redirect](https://agentprime.io/advisories/CVE-2026-107714.md)
  `CVE-2026-107714` · CVE record: sparklemotion mechanize · CVSS 5.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Weak cryptography or TLS, Hard-coded credentials
- [Security vulnerability affects the UNIX S-TAP component as part of IBM Guardium Data Protection](https://agentprime.io/advisories/CVE-2026-87980.md)
  `CVE-2026-87980` · CVE record: IBM Guardium Data Protection · CVSS 3.1 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware](https://agentprime.io/advisories/CVE-2026-102368.md)
  `CVE-2026-102368` · CVE record: TP-Link System Inc. Tapo S505 v1.6 · CVSS 5.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters](https://agentprime.io/advisories/GHSA-48qf-xh34-q73r.md)
  `GHSA-48qf-xh34-q73r`, `BIT-mariadb-2026-107383`, `BIT-mariadb-min-2026-107383`, `BIT-mysql-client-2026-107383`, `CVE-2026-107383` · npm `mariadb`: affected `<3.2.5 || >=3.3.0, <3.3.4 || >=3.4.0, <3.4.7 || >=3.5.0-rc.0, <3.5.4`, fixed in `3.2.5`, `3.3.4`, `3.4.7`, `3.5.4` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [IBM Guardium Data Protection Information Disclosure](https://agentprime.io/advisories/CVE-2026-84274.md)
  `CVE-2026-84274` · CVE record: IBM Guardium Data Protection · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [Docker Sandboxes egress proxy could forward unrecognized client credentials to managed hosts](https://agentprime.io/advisories/CVE-2026-105452.md)
  `CVE-2026-105452` · CVE record: Docker Docker Sandboxes · CVSS 5.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace](https://agentprime.io/advisories/GHSA-q7m5-3jmv-vm48.md)
  `GHSA-q7m5-3jmv-vm48`, `CVE-2026-61431`, `PYSEC-2026-4258` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal, Information disclosure
- [PraisonAI: Project custom command templates can read outside-workspace files into model prompts](https://agentprime.io/advisories/GHSA-xpx6-x8c2-mw5w.md)
  `GHSA-xpx6-x8c2-mw5w`, `CVE-2026-60088`, `PYSEC-2026-4261` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal, Information disclosure
- [Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when \`include_content=False\`](https://agentprime.io/advisories/GHSA-3gh4-cghq-f8v4.md)
  `GHSA-3gh4-cghq-f8v4`, `CVE-2026-107293`, `PYSEC-2026-4274`, `PYSEC-2026-4283` · PyPI `pydantic-ai` and 1 more: affected `>=0.3.4, <1.107.4 || >=2.0.0b1, <2.27.1`, fixed in `1.107.4`, `2.27.1` · CVSS 2.3 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, CWE-212
- [PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace](https://agentprime.io/advisories/GHSA-4xxv-6wmf-xf45.md)
  `GHSA-4xxv-6wmf-xf45`, `CVE-2026-61432`, `PYSEC-2026-4268` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal, Information disclosure
- [Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when \`include_content=False\`](https://agentprime.io/advisories/GHSA-4x9p-g9wm-8q7f.md)
  `GHSA-4x9p-g9wm-8q7f`, `CVE-2026-107291`, `PYSEC-2026-4275`, `PYSEC-2026-4284` · PyPI `pydantic-ai` and 1 more: affected `>=0.3.4, <1.107.6 || >=2.0.0b1, <2.44.0`, fixed in `1.107.6`, `2.44.0` · CVSS 2.3 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, CWE-212
- [PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets](https://agentprime.io/advisories/GHSA-2xv2-w8cq-5gxw.md)
  `GHSA-2xv2-w8cq-5gxw`, `CVE-2026-61447`, `PYSEC-2026-4266` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection, Information disclosure
- [PraisonAI: DNS rebinding bypass in \`web_crawl\` SSRF protection allows internal response disclosure](https://agentprime.io/advisories/GHSA-qg25-6gc4-48mg.md)
  `GHSA-qg25-6gc4-48mg`, `CVE-2026-61430`, `PYSEC-2026-4272` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 8.4 High · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Race condition, Server-side request forgery (SSRF)
- [Keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints](https://agentprime.io/advisories/CVE-2026-107604.md)
  `CVE-2026-107604` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors](https://agentprime.io/advisories/CVE-2026-105828.md)
  `CVE-2026-105828` · CVE record: parse-community parse-server · CVSS 6.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel](https://agentprime.io/advisories/CVE-2026-92555.md)
  `CVE-2026-92555` · CVE record: AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Brocade Active Support Connectivity Gateway](https://agentprime.io/advisories/CVE-2026-87426.md)
  `CVE-2026-87426` · CVE record: Brocade Brocade Active Support Connectivity Gateway · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Parameter](https://agentprime.io/advisories/CVE-2026-94275.md)
  `CVE-2026-94275` · CVE record: Unknown Track Orders for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [SMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User Actions](https://agentprime.io/advisories/CVE-2026-94258.md)
  `CVE-2026-94258` · CVE record: Unknown SMS Alert · CVSS 2.7 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export](https://agentprime.io/advisories/CVE-2026-94244.md)
  `CVE-2026-94244` · CVE record: Unknown Wallet System for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX](https://agentprime.io/advisories/CVE-2026-86826.md)
  `CVE-2026-86826` · CVE record: Unknown BackWPup · CVSS 5.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure](https://agentprime.io/advisories/CVE-2026-105195.md)
  `CVE-2026-105195` · CVE record: Unknown Booking Calendar · CVSS 2.7 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads Block](https://agentprime.io/advisories/CVE-2026-105194.md)
  `CVE-2026-105194` · CVE record: Unknown Easy Digital Downloads · CVSS 4.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [Insecure storage of sensitive information in Brocade SANnav](https://agentprime.io/advisories/CVE-2026-5047.md)
  `CVE-2026-5047` · CVE record: Brocade Brocade SANnav · CVSS 8.2 High · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [Sensitive information in log files in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87672.md)
  `CVE-2026-87672` · CVE record: Brocade Fabric OS · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros)](https://agentprime.io/advisories/CVE-2026-107315.md)
  `CVE-2026-107315` · CVE record: pgjdbc pgjdbc · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, CWE-226
- [Docling: Configured HTTP headers sent to every remote image host named by a document](https://agentprime.io/advisories/GHSA-p3fw-7699-7926.md)
  `GHSA-p3fw-7699-7926`, `CVE-2026-105742`, `PYSEC-2026-4189`, `PYSEC-2026-4212` · PyPI `docling` and 1 more: affected `>=2.95.0, <2.132.0`, fixed in `2.132.0` · CVSS 3.7 Low · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, Hard-coded credentials
- [Docling: Crafted DoclingDocument JSON embeds local image files into converted output](https://agentprime.io/advisories/GHSA-p944-4xh2-x776.md)
  `GHSA-p944-4xh2-x776`, `CVE-2026-105748`, `PYSEC-2026-4208`, `PYSEC-2026-4213` · PyPI `docling` and 1 more: affected `>=2.16.0, <2.131.0`, fixed in `2.131.0` · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, Information disclosure
- [Payload external upload trust validation issue](https://agentprime.io/advisories/GHSA-pj5h-5q6c-3pfx.md)
  `GHSA-pj5h-5q6c-3pfx`, `CVE-2026-105861` · npm `payload`: affected `>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 7.2 High · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, CWE-346
- [Ghost: Password Hash Ordering Disclosure in Ghost Admin API](https://agentprime.io/advisories/GHSA-53vv-xm9f-mm82.md)
  `GHSA-53vv-xm9f-mm82`, `BIT-ghost-2026-104415`, `BIT-ghost-2026-105652`, `CVE-2026-104415`, `CVE-2026-105652` · npm `ghost`: affected `>=0.7.2, <6.64.0`, fixed in `6.64.0` · CVSS 2.3 Low · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, Other injection
- [Ghost: Invite Token Disclosure in Ghost Admin API](https://agentprime.io/advisories/GHSA-v6q3-xqxm-6f5v.md)
  `GHSA-v6q3-xqxm-6f5v`, `BIT-ghost-2026-104416`, `BIT-ghost-2026-105675`, `CVE-2026-104416`, `CVE-2026-105675` · npm `ghost`: affected `>=4.39.0, <6.64.0`, fixed in `6.64.0` · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, Other injection
- [Backstage: Improper input validation in Sentry scaffolder actions](https://agentprime.io/advisories/GHSA-g734-fhp4-7mfp.md)
  `GHSA-g734-fhp4-7mfp`, `CVE-2026-106459` · npm `@backstage/plugin-scaffolder-backend-module-sentry`: affected `>=0.3.0, <0.3.8`, fixed in `0.3.8` · CVSS 8.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, Server-side request forgery (SSRF)
- [PraisonAI: Crawl4AI/Chromium backend is also affected by the \`web_crawl\` SSRF validation bypass](https://agentprime.io/advisories/GHSA-6g59-gm2v-qhvq.md)
  `GHSA-6g59-gm2v-qhvq`, `CVE-2026-61429`, `PYSEC-2026-4269` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 8.4 High · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, Race condition, Server-side request forgery (SSRF)
- [Apache Geode: Management REST API: Insertion of Sensitive Information into Log File](https://agentprime.io/advisories/CVE-2026-103371.md)
  `CVE-2026-103371` · CVE record: Apache Software Foundation Apache Geode · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections](https://agentprime.io/advisories/CVE-2026-107313.md)
  `CVE-2026-107313` · CVE record: pgjdbc pgjdbc · CVSS 4.2 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [Backstage has a sensitive information disclosure in Kubernetes resource queries](https://agentprime.io/advisories/GHSA-p795-mqf2-36mf.md)
  `GHSA-p795-mqf2-36mf`, `CVE-2026-106561` · npm `@backstage/plugin-kubernetes-backend`: affected `<0.21.9`, fixed in `0.21.9` · CVSS 5.0 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, Broken access control
- [Backstage: Sensitive information exposure in Scaffolder](https://agentprime.io/advisories/GHSA-g2v8-7jhw-pp8p.md)
  `GHSA-g2v8-7jhw-pp8p`, `CVE-2026-106501` · npm `@backstage/plugin-scaffolder-backend`: affected `<3.3.1 || >=3.4.0, <3.4.1 || >=4.0.0, <4.0.3 || >=4.0.4, <4.1.0`, fixed in `3.3.1`, `3.4.1`, `4.0.3`, `4.1.0` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [Backstage: Secret-derived values may be exposed in scaffolder task logs](https://agentprime.io/advisories/GHSA-mfvq-x7vr-rgqg.md)
  `GHSA-mfvq-x7vr-rgqg`, `CVE-2026-106499` · npm `@backstage/plugin-scaffolder-backend`: affected `<4.1.0`, fixed in `4.1.0` · CVSS 4.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [Backstage may expose sensitive information in Scaffolder task failure events](https://agentprime.io/advisories/GHSA-95p4-vv4g-jxxm.md)
  `GHSA-95p4-vv4g-jxxm`, `CVE-2026-106502` · npm `@backstage/plugin-scaffolder-backend`: affected `<4.1.0`, fixed in `4.1.0` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [Backstage has sensitive information exposure in scaffolder task logs](https://agentprime.io/advisories/GHSA-4xvq-3m68-h444.md)
  `GHSA-4xvq-3m68-h444`, `CVE-2026-106504` · npm `@backstage/plugin-scaffolder-backend`: affected `<4.1.0`, fixed in `4.1.0` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [Backstage has improper input validation in scaffolder task list ordering](https://agentprime.io/advisories/GHSA-vwp5-f99x-x3rq.md)
  `GHSA-vwp5-f99x-x3rq`, `CVE-2026-106506` · npm `@backstage/plugin-scaffolder-backend`: affected `<4.1.0`, fixed in `4.1.0` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, CWE-202
- [RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()](https://agentprime.io/advisories/GHSA-h6w7-qmcm-q6xr.md)
  `GHSA-h6w7-qmcm-q6xr`, `CVE-2026-106123` · Maven `com.rabbitmq:amqp-client`: affected `<5.35.0`, fixed in `5.35.0` · CVSS 5.7 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, \`.first\`/\`.last\`, negative index, and for-loop iteration](https://agentprime.io/advisories/GHSA-fwxr-j5w2-587m.md)
  `GHSA-fwxr-j5w2-587m`, `CVE-2026-106120` · npm `liquidjs`: affected `<10.27.2`, fixed in `10.27.2` · CVSS 6.0 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its \</script> escape is bypassable](https://agentprime.io/advisories/GHSA-r5mf-4r5x-q78f.md)
  `GHSA-r5mf-4r5x-q78f`, `CVE-2026-106106` · npm `@quasar/app-vite` and 1 more: affected `<3.3.0`, fixed in `3.3.0` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), Information disclosure
- [Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token](https://agentprime.io/advisories/GHSA-m62c-5q34-f3cf.md)
  `GHSA-m62c-5q34-f3cf`, `CVE-2026-57449` · npm `@actual-app/sync-server`: affected `<26.7.0`, fixed in `26.7.0` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, Broken access control
- [User Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_access](https://agentprime.io/advisories/CVE-2026-97331.md)
  `CVE-2026-97331` · CVE record: Unknown User Private Files · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget](https://agentprime.io/advisories/CVE-2026-96530.md)
  `CVE-2026-96530` · CVE record: Unknown Optimole · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API](https://agentprime.io/advisories/CVE-2026-86816.md)
  `CVE-2026-86816` · CVE record: Unknown WPCafe · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File](https://agentprime.io/advisories/CVE-2026-103378.md)
  `CVE-2026-103378` · CVE record: Unknown Geliver Akıllı Kargo Pazaryeri · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [Sensitive information in log files in ASUS Router](https://agentprime.io/advisories/CVE-2026-16528.md)
  `CVE-2026-16528` · CVE record: ASUS Router · CVSS 8.4 High · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-93677.md)
  `CVE-2026-93677` · CVE record: IBM Langflow OSS · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.](https://agentprime.io/advisories/CVE-2026-88514.md)
  `CVE-2026-88514` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [Gitea profile feed disclosure bypassing user visibility](https://agentprime.io/advisories/CVE-2026-97626.md)
  `CVE-2026-97626` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure, Broken access control
- [Gitea migration and pull mirror SSRF through multi-answer DNS](https://agentprime.io/advisories/CVE-2026-101029.md)
  `CVE-2026-101029` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure, Race condition, Server-side request forgery (SSRF)
- [Local Disclosure of Sensitive Information in HPE Networking ClearPass Policy Manager Client Software](https://agentprime.io/advisories/CVE-2026-79817.md)
  `CVE-2026-79817` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 5.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Unauthenticated Sensitive Information Disclosure in AOS-S](https://agentprime.io/advisories/CVE-2026-76749.md)
  `CVE-2026-76749` · CVE record: Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure

Newest: <https://agentprime.io/advisories/tag/info-disclosure.md>
Older: <https://agentprime.io/advisories/tag/info-disclosure.md?cursor=WyIyMDI2LTEwLTA2VDE5OjA2OjQxLjQzODAwMFoiLCJDVkUtMjAyNi03Njc0OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=info-disclosure&cursor=WyIyMDI2LTEwLTA4VDIyOjE1OjMxLjA3MjAwMFoiLCJDVkUtMjAyNi04Mzk0MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/info-disclosure/?cursor=WyIyMDI2LTEwLTA4VDIyOjE1OjMxLjA3MjAwMFoiLCJDVkUtMjAyNi04Mzk0MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.