# Information disclosure.

Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs](https://agentprime.io/advisories/GHSA-3325-v43h-43rv.md)
  `GHSA-3325-v43h-43rv`, `BIT-jupyterlab-2026-102904`, `CVE-2026-102904`, `PYSEC-2026-4055` · PyPI `jupyterlab`: affected `>=4.0.0, <4.5.11 || >=4.6.0, <4.6.4`, fixed in `4.5.11`, `4.6.4` · CVSS 5.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Command injection, Information disclosure, Server-side request forgery (SSRF)
- [devalue: \`stringify\`/\`uneval\` serialize shared memory](https://agentprime.io/advisories/GHSA-j22f-vq7h-c4qm.md)
  `GHSA-j22f-vq7h-c4qm`, `CVE-2026-92708` · npm `devalue`: affected `>=5.1.0, <5.9.3`, fixed in `5.9.3` · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure, CWE-226
- [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67106.md)
  `CVE-2026-67106` · CVE record: HCL Software HCL BigFix Service Management · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67104.md)
  `CVE-2026-67104` · CVE record: HCL Software HCL BigFix Service Management · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure, Hard-coded credentials
- [HCL iControl is affected by an Improper Error Handling vulnerability](https://agentprime.io/advisories/CVE-2026-66248.md)
  `CVE-2026-66248` · CVE record: HCL Software iControl · CVSS 3.1 Low · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-62058.md)
  `CVE-2026-62058` · CVE record: WPExperts CF7 Apps · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-103345.md)
  `CVE-2026-103345` · CVE record: Shamim Rajani Pie Register · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-103336.md)
  `CVE-2026-103336` · CVE record: Smackcoders Inc. WP Ultimate CSV Importer · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [Apache APISIX: data-mask may fail to redact request headers in logger output](https://agentprime.io/advisories/CVE-2026-78242.md)
  `CVE-2026-78242` · CVE record: Apache Software Foundation Apache APISIX · CVSS 5.7 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API](https://agentprime.io/advisories/CVE-2026-103281.md)
  `CVE-2026-103281` · CVE record: TryGhost Ghost · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint](https://agentprime.io/advisories/CVE-2026-103280.md)
  `CVE-2026-103280` · CVE record: TryGhost Ghost · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [Ghost 5.42.2 before 6.58.0 Password Hash Disclosure](https://agentprime.io/advisories/CVE-2026-103275.md)
  `CVE-2026-103275` · CVE record: TryGhost Ghost · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API](https://agentprime.io/advisories/CVE-2026-103272.md)
  `CVE-2026-103272` · CVE record: TryGhost Ghost · CVSS 8.7 High · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log](https://agentprime.io/advisories/CVE-2026-96255.md)
  `CVE-2026-96255` · CVE record: Unknown Payments for Hubtel · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters](https://agentprime.io/advisories/CVE-2026-92548.md)
  `CVE-2026-92548` · CVE record: hcabrera WP Popular Posts · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle](https://agentprime.io/advisories/GHSA-whh4-5q6c-9v3x.md)
  `GHSA-whh4-5q6c-9v3x`, `CVE-2026-87818`, `PYSEC-2026-3983` · PyPI `gitpython`: affected `>=3.1.59, <3.1.60`, fixed in `3.1.60` · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Command injection, Information disclosure
- [Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor](https://agentprime.io/advisories/CVE-2026-102121.md)
  `CVE-2026-102121` · CVE record: Kiteworks Secure Data Forms · CVSS 8.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure, Authentication bypass
- [Kiteworks Core Sandbox Escape](https://agentprime.io/advisories/CVE-2026-102125.md)
  `CVE-2026-102125` · CVE record: Kiteworks Core · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure, CWE-653
- [Information disclosure in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47514.md)
  `CVE-2026-47514` · CVE record: NVIDIA GeForce and 3 more · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [Information disclosure in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100258.md)
  `CVE-2026-100258` · CVE record: JetBrains YouTrack · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-97302.md)
  `CVE-2026-97302` · CVE record: Themeisle MPG · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-97261.md)
  `CVE-2026-97261` · CVE record: VillaTheme Notivo · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-97241.md)
  `CVE-2026-97241` · CVE record: PrecisionWP BackupEase · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-97240.md)
  `CVE-2026-97240` · CVE record: Esteban StifLi Backup Tools · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [Alert rules in restricted folders disclosed via the alert rules list API](https://agentprime.io/advisories/CVE-2026-13719.md)
  `CVE-2026-13719` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure, Broken access control
- [Moodle: user profile information disclosure via grade web service](https://agentprime.io/advisories/CVE-2026-102579.md)
  `CVE-2026-102579` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [Sensitive information in log files in Pgpool Global Development Group Pgpool-II](https://agentprime.io/advisories/CVE-2026-92872.md)
  `CVE-2026-92872` · CVE record: Pgpool Global Development Group Pgpool-II · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export](https://agentprime.io/advisories/CVE-2026-96886.md)
  `CVE-2026-96886` · CVE record: Unknown Course Booking System · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API](https://agentprime.io/advisories/CVE-2026-94274.md)
  `CVE-2026-94274` · CVE record: Unknown YayReviews · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [Image Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission Callbacks](https://agentprime.io/advisories/CVE-2026-90953.md)
  `CVE-2026-90953` · CVE record: Unknown Image Optimizer · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes](https://agentprime.io/advisories/CVE-2026-86789.md)
  `CVE-2026-86789` · CVE record: Unknown Connections Business Directory · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass](https://agentprime.io/advisories/CVE-2026-83560.md)
  `CVE-2026-83560` · CVE record: Unknown New User Approve · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes](https://agentprime.io/advisories/CVE-2026-80333.md)
  `CVE-2026-80333` · CVE record: Unknown Solace Extra · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [gedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure](https://agentprime.io/advisories/CVE-2026-102845.md)
  `CVE-2026-102845` · CVE record: gedelumbung HospitalManagement · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure, Broken access control
- [PyJWT: PyJWKClient follows redirects when fetching JWKS](https://agentprime.io/advisories/GHSA-9v7f-9g4p-ffgj.md)
  `GHSA-9v7f-9g4p-ffgj`, `CVE-2026-102267`, `PYSEC-2026-4144` · PyPI `pyjwt`: affected `<2.14.0`, fixed in `2.14.0` · CVSS 7.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure, Server-side request forgery (SSRF), CWE-345
- [Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B](https://agentprime.io/advisories/CVE-2026-90441.md)
  `CVE-2026-90441` · CVE record: WatchGuard Fireware OS · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure, Denial of service, Broken access control
- [Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties](https://agentprime.io/advisories/CVE-2026-71379.md)
  `CVE-2026-71379` · CVE record: Toptech Systems TMS7 and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Authenticated Local Sensitive Information Disclosure in HPE Networking Instant On](https://agentprime.io/advisories/CVE-2026-76735.md)
  `CVE-2026-76735` · CVE record: Hewlett Packard Enterprise (HPE) Instant ON · CVSS 4.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches](https://agentprime.io/advisories/GHSA-2jfj-6hjv-fm6j.md)
  `GHSA-2jfj-6hjv-fm6j`, `CVE-2026-84933` · npm `undici`: affected `>=7.0.0, <7.29.1 || >=8.0.0, <8.10.2`, fixed in `7.29.1`, `8.10.2` · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure, CWE-524
- [Information disclosure in Eclipse Foundation Eclipse ThreadX](https://agentprime.io/advisories/CVE-2026-102709.md)
  `CVE-2026-102709` · CVE record: Eclipse Foundation Eclipse ThreadX · CVSS 8.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure, Memory corruption, CWE-501
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-95367.md)
  `CVE-2026-95367` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-95327.md)
  `CVE-2026-95327` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-95312.md)
  `CVE-2026-95312` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-95336.md)
  `CVE-2026-95336` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-95295.md)
  `CVE-2026-95295` · CVE record: Google Chrome · CVSS 4.6 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)](https://agentprime.io/advisories/CVE-2026-100244.md)
  `CVE-2026-100244` · CVE record: Wikimedia Foundation Mediawiki - CentralAuth Extension · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Private change tags exposed to anonymous users via revision-tags-change events](https://agentprime.io/advisories/CVE-2026-100241.md)
  `CVE-2026-100241` · CVE record: Wikimedia Foundation Mediawiki - EventBus Extension · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Cleartext storage of sensitive information in Devolutions Server](https://agentprime.io/advisories/CVE-2026-100288.md)
  `CVE-2026-100288` · CVE record: Devolutions Server · CVSS 7.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Information disclosure in Devolutions Server](https://agentprime.io/advisories/CVE-2026-100286.md)
  `CVE-2026-100286` · CVE record: Devolutions Server · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Sensitive information leak through hidden menu](https://agentprime.io/advisories/CVE-2026-22101.md)
  `CVE-2026-22101` · CVE record: EVbee DC-80 · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Sensitive Data Exposure in Parla Auto's DetaWix Mobile Web Portal](https://agentprime.io/advisories/CVE-2026-86450.md)
  `CVE-2026-86450` · CVE record: Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Other issue in the DevTools component](https://agentprime.io/advisories/CVE-2026-100810.md)
  `CVE-2026-100810` · CVE record: Mozilla Thunderbird and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Information disclosure in the Networking component](https://agentprime.io/advisories/CVE-2026-96869.md)
  `CVE-2026-96869` · CVE record: Mozilla Thunderbird and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Information disclosure in the Networking: JAR component](https://agentprime.io/advisories/CVE-2026-100766.md)
  `CVE-2026-100766` · CVE record: Mozilla Firefox and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs](https://agentprime.io/advisories/CVE-2026-81862.md)
  `CVE-2026-81862` · CVE record: Apache Software Foundation Apache Airflow Teradata provider · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Intelbras TIP 125i Básico sensitive information in source](https://agentprime.io/advisories/CVE-2026-101265.md)
  `CVE-2026-101265` · CVE record: Intelbras TIP 125i · CVSS 2.3 Low · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure, CWE-540
- [SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages](https://agentprime.io/advisories/CVE-2026-101092.md)
  `CVE-2026-101092` · CVE record: siyuan-note siyuan · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure
- [Eleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosure](https://agentprime.io/advisories/CVE-2026-101146.md)
  `CVE-2026-101146` · CVE record: Eleveo Quality Management · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure, Broken access control
- [Eleveo Quality Management QMBODownload information disclosure](https://agentprime.io/advisories/CVE-2026-101143.md)
  `CVE-2026-101143` · CVE record: Eleveo Quality Management · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure, Broken access control
- [PMWeb encryptionhelper.dll information disclosure](https://agentprime.io/advisories/CVE-2026-101083.md)
  `CVE-2026-101083` · CVE record: PMWeb · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure, Broken access control

Newest: <https://agentprime.io/advisories/tag/info-disclosure.md>
Older: <https://agentprime.io/advisories/tag/info-disclosure.md?cursor=WyIyMDI2LTA5LTI4VDE2OjQ1OjA3Ljc2NTAwMFoiLCJDVkUtMjAyNi0xMDEwODMiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=info-disclosure&cursor=WyIyMDI2LTEwLTAxVDE1OjM4OjI2LjAwMDAwMFoiLCJHSFNBLWg4NWotaHYzYy1xZmdxIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/info-disclosure/?cursor=WyIyMDI2LTEwLTAxVDE1OjM4OjI2LjAwMDAwMFoiLCJHSFNBLWg4NWotaHYzYy1xZmdxIl0>. Everything for agents: <https://agentprime.io/llms.txt>.