# Information disclosure.

Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Webkul Aureus ERP composer.json insertion of sensitive information into debugging code](https://agentprime.io/advisories/CVE-2026-112190.md)
  `CVE-2026-112190` · CVE record: Webkul Aureus ERP · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, CWE-215
- [FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint](https://agentprime.io/advisories/CVE-2026-111056.md)
  `CVE-2026-111056` · CVE record: FOSSBilling FOSSBilling · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Authentication bypass, CWE-204
- [FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists](https://agentprime.io/advisories/CVE-2026-111053.md)
  `CVE-2026-111053` · CVE record: FOSSBilling FOSSBilling · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal, Information disclosure
- [ai-genius-automations octoally index.ts information disclosure](https://agentprime.io/advisories/CVE-2026-112147.md)
  `CVE-2026-112147` · CVE record: ai-genius-automations octoally · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Broken access control
- [satya-vinay Events-Management-System project.sql file access](https://agentprime.io/advisories/CVE-2026-112144.md)
  `CVE-2026-112144` · CVE record: satya-vinay Events-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control, Information disclosure
- [Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions](https://agentprime.io/advisories/CVE-2026-85315.md)
  `CVE-2026-85315` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure
- [Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default](https://agentprime.io/advisories/CVE-2026-85260.md)
  `CVE-2026-85260` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure
- [Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions](https://agentprime.io/advisories/CVE-2026-85257.md)
  `CVE-2026-85257` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure
- [Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets](https://agentprime.io/advisories/CVE-2026-85251.md)
  `CVE-2026-85251` · CVE record: Apache Software Foundation Apache Camel · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure
- [Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions](https://agentprime.io/advisories/CVE-2026-85246.md)
  `CVE-2026-85246` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure
- [Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions](https://agentprime.io/advisories/CVE-2026-84180.md)
  `CVE-2026-84180` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure
- [Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers](https://agentprime.io/advisories/CVE-2026-78164.md)
  `CVE-2026-78164` · CVE record: Apache Software Foundation Apache Camel · CVSS 8.2 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Code injection
- [Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure](https://agentprime.io/advisories/CVE-2026-78163.md)
  `CVE-2026-78163` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal, Information disclosure, Server-side request forgery (SSRF)
- [Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles](https://agentprime.io/advisories/CVE-2026-76994.md)
  `CVE-2026-76994` · CVE record: Apache Software Foundation Apache Answer · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure
- [MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings](https://agentprime.io/advisories/CVE-2026-112192.md)
  `CVE-2026-112192` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Broken access control
- [Apache Answer: API keys logged in plaintext during authentication](https://agentprime.io/advisories/CVE-2026-64943.md)
  `CVE-2026-64943` · CVE record: Apache Software Foundation Apache Answer · CVSS 8.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure
- [MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution](https://agentprime.io/advisories/CVE-2026-112188.md)
  `CVE-2026-112188` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Broken access control
- [Apache Kylin: Potential unauthenticated job metadata replacement](https://agentprime.io/advisories/CVE-2026-108823.md)
  `CVE-2026-108823` · CVE record: Apache Software Foundation Apache Kylin · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure
- [MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances](https://agentprime.io/advisories/CVE-2026-112179.md)
  `CVE-2026-112179` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure
- [Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure](https://agentprime.io/advisories/CVE-2026-112091.md)
  `CVE-2026-112091` · CVE record: Dav-ee dairy-management-system · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Broken access control
- [FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File](https://agentprime.io/advisories/CVE-2026-89286.md)
  `CVE-2026-89286` · CVE record: Unknown FormFlow for GoHighLevel (GHL) · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure
- [Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)](https://agentprime.io/advisories/CVE-2026-103091.md)
  `CVE-2026-103091` · CVE record: Google SAM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Authentication bypass, Broken access control, CWE-1188
- [light0011 cms Uploadify check-exists.php file_exists file information disclosure](https://agentprime.io/advisories/CVE-2026-112027.md)
  `CVE-2026-112027` · CVE record: light0011 cms · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Information disclosure
- [Gitea private profile information disclosure through POST request](https://agentprime.io/advisories/CVE-2026-110324.md)
  `CVE-2026-110324` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Information disclosure
- [Gitea draft release creation disclosing attachment metadata](https://agentprime.io/advisories/CVE-2026-110311.md)
  `CVE-2026-110311` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Information disclosure
- [Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage](https://agentprime.io/advisories/CVE-2026-111993.md)
  `CVE-2026-111993` · CVE record: Soarkey StudentManagement · CVSS 4.8 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Information disclosure, CWE-310
- [Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions](https://agentprime.io/advisories/CVE-2026-110069.md)
  `CVE-2026-110069` · CVE record: Unknown Modern Events Calendar Lite · CVSS 4.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Information disclosure
- [Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint](https://agentprime.io/advisories/CVE-2026-111930.md)
  `CVE-2026-111930` · CVE record: coder coder · CVSS 5.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Information disclosure
- [Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest](https://agentprime.io/advisories/CVE-2026-111926.md)
  `CVE-2026-111926` · CVE record: coder coder · CVSS 4.8 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Information disclosure
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API](https://agentprime.io/advisories/CVE-2026-111904.md)
  `CVE-2026-111904` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Information disclosure
- [WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-110889.md)
  `CVE-2026-110889` · CVE record: Gantry Gantry 5 Framework · CVSS 7.5 High · Not analysed yet · Published 17 Oct 2026 · Tags: Information disclosure
- [ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection](https://agentprime.io/advisories/CVE-2026-97314.md)
  `CVE-2026-97314` · CVE record: Unknown ThirstyAffiliates · CVSS 6.5 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Information disclosure
- [PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check](https://agentprime.io/advisories/CVE-2026-103376.md)
  `CVE-2026-103376` · CVE record: Unknown PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) · CVSS 5.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Information disclosure
- [Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer\[uuid\]' Parameter](https://agentprime.io/advisories/CVE-2026-111602.md)
  `CVE-2026-111602` · CVE record: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress · CVSS 3.7 Low · Not analysed yet · Published 17 Oct 2026 · Tags: Information disclosure
- [Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host](https://agentprime.io/advisories/CVE-2026-96626.md)
  `CVE-2026-96626` · CVE record: getarcaneapp arcane · CVSS 8.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure, Hard-coded credentials
- [Apache Kylin: Broken Access Control in QuerySQLBlacklistController](https://agentprime.io/advisories/CVE-2026-69080.md)
  `CVE-2026-69080` · CVE record: Apache Software Foundation Apache Kylin · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Apache Kylin: JobController allows unauthorized cross-project manipulation](https://agentprime.io/advisories/CVE-2026-69077.md)
  `CVE-2026-69077` · CVE record: Apache Software Foundation Apache Kylin · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Apache Kylin: Unauthorized cross-project job discard](https://agentprime.io/advisories/CVE-2026-69076.md)
  `CVE-2026-69076` · CVE record: Apache Software Foundation Apache Kylin · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Apache Kylin: Unauthorized SQL execution to Spark SQL env](https://agentprime.io/advisories/CVE-2026-68572.md)
  `CVE-2026-68572` · CVE record: Apache Software Foundation Apache Kylin · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [libIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileRead](https://agentprime.io/advisories/CVE-2026-48503.md)
  `CVE-2026-48503` · CVE record: mz-automation libiec61850 · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption, Information disclosure, CWE-252
- [Discourse Doc Categories: Doc category index refresh leaks private topic titles](https://agentprime.io/advisories/CVE-2026-57447.md)
  `CVE-2026-57447` · CVE record: discourse discourse-doc-categories · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)](https://agentprime.io/advisories/CVE-2026-55836.md)
  `CVE-2026-55836` · CVE record: open-zaak open-zaak · CVSS 6.8 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Apache Kylin: Low-Privilege Config Exposure](https://agentprime.io/advisories/CVE-2026-63618.md)
  `CVE-2026-63618` · CVE record: Apache Software Foundation Apache Kylin · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key](https://agentprime.io/advisories/CVE-2026-109930.md)
  `CVE-2026-109930` · CVE record: Unknown MAIO · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status](https://agentprime.io/advisories/CVE-2026-18560.md)
  `CVE-2026-18560` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts](https://agentprime.io/advisories/CVE-2026-19600.md)
  `CVE-2026-19600` · CVE record: Mattermost Mattermost · CVSS 4.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads](https://agentprime.io/advisories/CVE-2026-19621.md)
  `CVE-2026-19621` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Private channel ID disclosure via user status endpoints](https://agentprime.io/advisories/CVE-2026-19603.md)
  `CVE-2026-19603` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Disclosure of AD/LDAP bind password via Test Connection](https://agentprime.io/advisories/CVE-2026-19601.md)
  `CVE-2026-19601` · CVE record: Mattermost Mattermost · CVSS 4.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Outgoing OAuth connection client secret exposure during connection validation](https://agentprime.io/advisories/CVE-2026-19541.md)
  `CVE-2026-19541` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email](https://agentprime.io/advisories/CVE-2026-109401.md)
  `CVE-2026-109401` · CVE record: smub WP Mail Logging · CVSS 2.7 Low · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script](https://agentprime.io/advisories/CVE-2026-107646.md)
  `CVE-2026-107646` · CVE record: realmag777 HUSKY – Products Filter for WooCommerce Professional · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions](https://agentprime.io/advisories/CVE-2026-110191.md)
  `CVE-2026-110191` · CVE record: Unknown Product Delivery Date for WooCommerce · CVSS 2.7 Low · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming](https://agentprime.io/advisories/CVE-2026-110012.md)
  `CVE-2026-110012` · CVE record: Unknown Salon Booking System · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget](https://agentprime.io/advisories/CVE-2026-105974.md)
  `CVE-2026-105974` · CVE record: Unknown Visual Form Builder · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons](https://agentprime.io/advisories/CVE-2026-74923.md)
  `CVE-2026-74923` · CVE record: Unknown Document Gallery · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure](https://agentprime.io/advisories/CVE-2026-92427.md)
  `CVE-2026-92427` · CVE record: Unknown Coinsnap Bitcoin Crowdfunding · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie](https://agentprime.io/advisories/CVE-2026-91830.md)
  `CVE-2026-91830` · CVE record: Unknown Subscribe to Comments · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML](https://agentprime.io/advisories/CVE-2026-109191.md)
  `CVE-2026-109191` · CVE record: extendthemes Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary…](https://agentprime.io/advisories/CVE-2026-88755.md)
  `CVE-2026-88755` · CVE record · CVSS 7.8 High · Not analysed yet · Published 16 Oct 2026 · Tags: Command injection, Information disclosure, Broken access control

Newest: <https://agentprime.io/advisories/tag/info-disclosure.md>
Older: <https://agentprime.io/advisories/tag/info-disclosure.md?cursor=WyIyMDI2LTEwLTE2VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi04ODc1NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=info-disclosure&cursor=WyIyMDI2LTEwLTE5VDE2OjM1OjAxLjcyODAwMFoiLCJDVkUtMjAyNi0xMDcxODciXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/info-disclosure/?cursor=WyIyMDI2LTEwLTE5VDE2OjM1OjAxLjcyODAwMFoiLCJDVkUtMjAyNi0xMDcxODciXQ>. Everything for agents: <https://agentprime.io/llms.txt>.