# Information disclosure.

Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Talos Linux: Support bundle does not redact registry credentials](https://agentprime.io/advisories/GHSA-7cxh-94cf-mfp6.md)
  `GHSA-7cxh-94cf-mfp6`, `CVE-2026-77564` · Go `github.com/siderolabs/talos`: affected `<1.14.0-alpha.0.0.20260513110206-76080416beee`, fixed in `1.14.0-alpha.0.0.20260513110206-76080416beee` · CVSS 3.3 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Information disclosure
- [WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-110361.md)
  `CVE-2026-110361` · CVE record: ClikIT Infinite Uploads · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Information disclosure
- [GitHub CLI partially discloses authentication tokens in \`gh auth status\` output](https://agentprime.io/advisories/GHSA-cg6r-mpgc-h9mm.md)
  `GHSA-cg6r-mpgc-h9mm`, `CVE-2026-64652`, `GO-2026-6766` · Go `github.com/cli/cli/v2`: affected `<2.97.0`, fixed in `2.97.0` · CVSS 3.3 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Information disclosure
- [WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-109695.md)
  `CVE-2026-109695` · CVE record: WPManageNinja FluentCart · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Information disclosure
- [SessionAuthentication Serializes Plaintext Password to Session Store](https://agentprime.io/advisories/GHSA-q6wx-j9wr-fj7f.md)
  `GHSA-q6wx-j9wr-fj7f`, `CVE-2026-19864` · Maven `org.eclipse.jetty:jetty-security`: affected `>=9.4.0, <=9.4.64 || >=10.0.0, <=10.0.32 || >=11.0.0, <=11.0.32 || >=12.0.0, <=12.0.38 || >=12.1.0, <=12.1.12`, fixed in `9.4.65`, `10.0.33`, `11.0.33`, `12.0.39`, `12.1.13` · CVSS 5.6 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Information disclosure
- [Jetty HttpClient leaks scoped credentials across path boundaries after a dot-segment redirect](https://agentprime.io/advisories/GHSA-qfr2-43g5-g768.md)
  `GHSA-qfr2-43g5-g768`, `CVE-2026-76184` · Maven `org.eclipse.jetty:jetty-client`: affected `>=12.1.0, <=12.1.12 || >=12.0.0, <=12.0.38 || >=11.0.0, <=11.0.32 || >=10.0.0, <=10.0.32 || >=9.4.0, <=9.4.64`, fixed in `9.4.65`, `10.0.33`, `11.0.33`, `12.0.39`, `12.1.13` · CVSS 8.2 High · Not analysed yet · Published 15 Oct 2026 · Tags: Information disclosure
- [Jetty HttpClient accepts proxy authentication challenges from an HTTPS origin and discloses proxy credentials inside the tunnel](https://agentprime.io/advisories/GHSA-r2c5-3p8g-wpvw.md)
  `GHSA-r2c5-3p8g-wpvw`, `CVE-2026-77711` · Maven `org.eclipse.jetty:jetty-client`: affected `>=12.1.0, <=12.1.12 || >=12.0.0, <=12.0.38 || >=11.0.0, <=11.0.32 || >=10.0.0, <=10.0.32 || >=9.4.0, <=9.4.64`, fixed in `9.4.65`, `10.0.33`, `11.0.33`, `12.0.39`, `12.1.13` · CVSS 8.2 High · Not analysed yet · Published 15 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Ministry of Land, Infrastructure… and others](https://agentprime.io/advisories/CVE-2026-75559.md)
  `CVE-2026-75559` · CVE record: Ministry of Land, Infrastructure, Transport and Tourism Vehicle Inspection Certificate Viewer (for Android) and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Information disclosure
- [Cleartext storage of sensitive information in GEO CORPORATION "ゲオアプリ" for Android and others](https://agentprime.io/advisories/CVE-2026-105271.md)
  `CVE-2026-105271` · CVE record: GEO CORPORATION "ゲオアプリ" for Android and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Information disclosure
- [Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.](https://agentprime.io/advisories/CVE-2026-78851.md)
  `CVE-2026-78851` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal, Information disclosure
- [itsmeravitejak Online-Examination-System dbtables.sql information disclosure](https://agentprime.io/advisories/CVE-2026-110696.md)
  `CVE-2026-110696` · CVE record: itsmeravitejak Online-Examination-System · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Broken access control
- [FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php](https://agentprime.io/advisories/CVE-2026-104110.md)
  `CVE-2026-104110` · CVE record: error311 FileRise · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Authentication bypass
- [FileRise: Missing Authentication Guard on File Snippet Preview Endpoint](https://agentprime.io/advisories/CVE-2026-64856.md)
  `CVE-2026-64856` · CVE record: error311 FileRise · CVSS 3.7 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Authentication bypass
- [WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php](https://agentprime.io/advisories/CVE-2026-55682.md)
  `CVE-2026-55682` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Authentication bypass
- [Insecure storage of sensitive information in Dell OS Recovery Tool](https://agentprime.io/advisories/CVE-2026-82153.md)
  `CVE-2026-82153` · CVE record: Dell OS Recovery Tool · CVSS 2.2 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Apprise forwards configured auth headers across cross-origin HTTP redirects](https://agentprime.io/advisories/GHSA-856c-92hv-3vxx.md)
  `GHSA-856c-92hv-3vxx`, `CVE-2026-59180`, `PYSEC-2026-4200` · PyPI `apprise`: affected `<1.11.0`, fixed in `1.11.0` · CVSS 3.1 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Open redirect
- [Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils\[.\]py](https://agentprime.io/advisories/CVE-2026-110248.md)
  `CVE-2026-110248` · CVE record: AWS SageMaker Python SDK · CVSS 6.0 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [dbt: Unauthenticated Arbitrary SQL Execution in \`dbt docs serve\`](https://agentprime.io/advisories/CVE-2026-100406.md)
  `CVE-2026-100406` · CVE record: dbt-labs dbt-core · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal, Information disclosure, Authentication bypass
- [Evolution-data-server: local file disclosure via attach file:// uris](https://agentprime.io/advisories/CVE-2026-110777.md)
  `CVE-2026-110777` · CVE record: GNOME evolution-data-server and 4 more · CVSS 5.7 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [FOG adInfo endpoint is reported to disclose the Active Directory join password](https://agentprime.io/advisories/CVE-2026-54554.md)
  `CVE-2026-54554` · CVE record: FOGProject fogproject · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Discourse: Media uploads remain publicly accessible after category permissions are restricted](https://agentprime.io/advisories/CVE-2026-91157.md)
  `CVE-2026-91157` · CVE record: discourse discourse · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Broken access control
- [VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink targets, and DeviceObject reference count to any client of \\\\.\VeraCrypt](https://agentprime.io/advisories/CVE-2026-77572.md)
  `CVE-2026-77572` · CVE record: veracrypt VeraCrypt · CVSS 3.3 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Sensitive information in log files in Dell Terraform Provider for OME](https://agentprime.io/advisories/CVE-2026-91883.md)
  `CVE-2026-91883` · CVE record: Dell Terraform Provider for OME · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Sensitive information in error messages in Dell Terraform Provider for OME](https://agentprime.io/advisories/CVE-2026-91882.md)
  `CVE-2026-91882` · CVE record: Dell Terraform Provider for OME · CVSS 8.6 High · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [MOVEit Transfer Local Disclosure of Session Information Vulnerability](https://agentprime.io/advisories/CVE-2026-89075.md)
  `CVE-2026-89075` · CVE record: Progress MOVEit Transfer · CVSS 7.3 High · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Sensitive information in log files in Dell Terraform Provider for Redfish](https://agentprime.io/advisories/CVE-2026-76113.md)
  `CVE-2026-76113` · CVE record: Dell Terraform Provider for Redfish · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Gitea hidden-owner repository listing disclosure](https://agentprime.io/advisories/CVE-2026-73135.md)
  `CVE-2026-73135` · CVE record: Gitea Gitea · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Gitea restricted-user organization metadata disclosure](https://agentprime.io/advisories/CVE-2026-66853.md)
  `CVE-2026-66853` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Broken access control
- [Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file](https://agentprime.io/advisories/CVE-2026-109968.md)
  `CVE-2026-109968` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access](https://agentprime.io/advisories/CVE-2026-108070.md)
  `CVE-2026-108070` · CVE record: TSplus TSplus Remote Access · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Clevis: clevis: pkcs#11 token pin written to world-readable file](https://agentprime.io/advisories/CVE-2026-109970.md)
  `CVE-2026-109970` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Unauthorised disclosure of information on Copart’s online billing service](https://agentprime.io/advisories/CVE-2026-14851.md)
  `CVE-2026-14851` · CVE record: Copart Copart’s online billing service · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion](https://agentprime.io/advisories/CVE-2026-103380.md)
  `CVE-2026-103380` · CVE record: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [WisdomGarden｜Tronclass - Sensitive Data Exposure](https://agentprime.io/advisories/CVE-2026-110466.md)
  `CVE-2026-110466` · CVE record: WisdomGarden Tronclass · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page](https://agentprime.io/advisories/CVE-2026-96904.md)
  `CVE-2026-96904` · CVE record: Unknown AWP Classifieds · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints](https://agentprime.io/advisories/CVE-2026-90989.md)
  `CVE-2026-90989` · CVE record: Unknown Tainacan · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure](https://agentprime.io/advisories/CVE-2026-107320.md)
  `CVE-2026-107320` · CVE record: Unknown GamiPress · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export](https://agentprime.io/advisories/CVE-2026-106099.md)
  `CVE-2026-106099` · CVE record: Unknown WP Data Access · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure](https://agentprime.io/advisories/CVE-2026-105969.md)
  `CVE-2026-105969` · CVE record: Unknown CodeAtoZ B2B Suite for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args\[link_target\]' Parameter via {user_meta} Dynamic Data Token](https://agentprime.io/advisories/CVE-2026-97471.md)
  `CVE-2026-97471` · CVE record: themefusion Avada (Fusion) Builder · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator](https://agentprime.io/advisories/CVE-2026-86607.md)
  `CVE-2026-86607` · CVE record: Hitachi Hitachi Ops Center Administrator · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-110141.md)
  `CVE-2026-110141` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-110146.md)
  `CVE-2026-110146` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability](https://agentprime.io/advisories/GHSA-wxxw-5cvc-53j7.md)
  `GHSA-wxxw-5cvc-53j7`, `CVE-2026-66822` · NuGet `Microsoft.NETCore.App.Runtime.linux-arm` and 10 more: affected `>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2`, fixed in `8.0.32`, `9.0.21`, `10.0.13`, `11.0.0-rc.2` · CVSS 5.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [IBM WebSphere Application Server Liberty Information Disclosure](https://agentprime.io/advisories/CVE-2026-14909.md)
  `CVE-2026-14909` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Improper Request Handling for Active Directory Logins in auth0-lock](https://agentprime.io/advisories/CVE-2026-107370.md)
  `CVE-2026-107370` · CVE record: Auth0 auth0-lock · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure, CWE-598
- [Active Directory Federation Services (AD FS) Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-97788.md)
  `CVE-2026-97788` · CVE record: Microsoft Microsoft .NET Framework 3.5 and 4 more · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Windows Client Side Caching driver (csc.sys) Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-96948.md)
  `CVE-2026-96948` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Windows Storage Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-96944.md)
  `CVE-2026-96944` · CVE record: Microsoft Windows 11 Version 24H2 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Windows ALPC Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-85866.md)
  `CVE-2026-85866` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Microsoft Trace Data Helper Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-70261.md)
  `CVE-2026-70261` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Microsoft Trace Data Helper Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-70260.md)
  `CVE-2026-70260` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Windows Kernel Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83925.md)
  `CVE-2026-83925` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure, Memory corruption
- [Windows Hello Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83907.md)
  `CVE-2026-83907` · CVE record: Microsoft Windows 10 Version 21H2 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Windows Shell Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83905.md)
  `CVE-2026-83905` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Windows Win32 Kernel Subsystem Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83897.md)
  `CVE-2026-83897` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Windows Common Log File System Driver Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83835.md)
  `CVE-2026-83835` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure, CWE-126
- [Windows NTFS Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83786.md)
  `CVE-2026-83786` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Windows Win32 Kernel Subsystem Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83774.md)
  `CVE-2026-83774` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Windows MIDI Service Module Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83773.md)
  `CVE-2026-83773` · CVE record: Microsoft Windows 11 Version 24H2 and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure

Newest: <https://agentprime.io/advisories/tag/info-disclosure.md>
Older: <https://agentprime.io/advisories/tag/info-disclosure.md?cursor=WyIyMDI2LTEwLTEzVDE5OjAwOjU0Ljc4NzAwMFoiLCJDVkUtMjAyNi04Mzc3MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=info-disclosure&cursor=WyIyMDI2LTEwLTE2VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi04ODc1NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/info-disclosure/?cursor=WyIyMDI2LTEwLTE2VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi04ODc1NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.