# Information disclosure.

Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions](https://agentprime.io/advisories/CVE-2026-101259.md)
  `CVE-2026-101259` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure
- [NocoDB Sign-in Endpoint AuthService.validateUser information disclosure](https://agentprime.io/advisories/CVE-2026-116122.md)
  `CVE-2026-116122` · CVE record: NocoDB · CVSS 6.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure, Broken access control
- [libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c.](https://agentprime.io/advisories/CVE-2026-104596.md)
  `CVE-2026-104596` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure
- [Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests](https://agentprime.io/advisories/CVE-2026-116193.md)
  `CVE-2026-116193` · CVE record: rclone rclone · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Information disclosure
- [rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect](https://agentprime.io/advisories/CVE-2026-116190.md)
  `CVE-2026-116190` · CVE record: rclone rclone · CVSS 6.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Information disclosure
- [Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions](https://agentprime.io/advisories/CVE-2026-116161.md)
  `CVE-2026-116161` · CVE record: parse-community parse-server · CVSS 6.0 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Information disclosure
- [GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route](https://agentprime.io/advisories/CVE-2026-111976.md)
  `CVE-2026-111976` · CVE record: Unknown GiveWP · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Information disclosure
- [WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-114190.md)
  `CVE-2026-114190` · CVE record: Hai Zheng / Lite Speed Cache LiteSpeed Cache · CVSS 5.9 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Information disclosure
- [GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action](https://agentprime.io/advisories/CVE-2026-113492.md)
  `CVE-2026-113492` · CVE record: Unknown GeoDirectory · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Information disclosure
- [GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint](https://agentprime.io/advisories/CVE-2026-113490.md)
  `CVE-2026-113490` · CVE record: Unknown GeoDirectory · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Information disclosure
- [SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin](https://agentprime.io/advisories/GHSA-rpx2-p6hp-x5gj.md)
  `GHSA-rpx2-p6hp-x5gj`, `CVE-2026-62204`, `GO-2026-6834` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260808010544-26ccb40d390e`, fixed in `0.0.0-20260808010544-26ccb40d390e` · CVSS 5.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Information disclosure, CWE-345
- [SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden](https://agentprime.io/advisories/GHSA-4pjg-x8qj-33j5.md)
  `GHSA-4pjg-x8qj-33j5`, `CVE-2026-73630`, `GO-2026-6828` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260731093152-c7522b8db586`, fixed in `0.0.0-20260731093152-c7522b8db586` · CVSS 6.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Information disclosure
- [obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields](https://agentprime.io/advisories/GHSA-43r2-c7g8-prc8.md)
  `GHSA-43r2-c7g8-prc8`, `CVE-2026-77362` · npm `obsidian-tc`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 4.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Information disclosure, Broken access control
- [obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default](https://agentprime.io/advisories/GHSA-cvp8-vvgf-69q4.md)
  `GHSA-cvp8-vvgf-69q4`, `CVE-2026-77364` · npm `obsidian-tc`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Information disclosure, Broken access control
- [Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer](https://agentprime.io/advisories/CVE-2026-46651.md)
  `CVE-2026-46651` · CVE record: intranda goobi-viewer-core · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, Information disclosure, Server-side request forgery (SSRF)
- [baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure](https://agentprime.io/advisories/CVE-2026-114623.md)
  `CVE-2026-114623` · CVE record: baserproject basercms · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal, Information disclosure, Broken access control
- [Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin](https://agentprime.io/advisories/CVE-2026-55826.md)
  `CVE-2026-55826` · CVE record: stape-io gtm-server-side-wordpress-plugin · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Information disclosure
- [odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure](https://agentprime.io/advisories/CVE-2026-53920.md)
  `CVE-2026-53920` · CVE record: openwrt odhcpd · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Memory corruption, Information disclosure, CWE-126
- [Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments](https://agentprime.io/advisories/GHSA-ffw9-w85g-f2vh.md)
  `GHSA-ffw9-w85g-f2vh`, `CVE-2026-105963`, `EEF-CVE-2026-105963` · Hex `plug` and 1 more: affected `>=1.6.3, <1.7.0`, fixed in `1.7.0` · CVSS 5.1 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Information disclosure
- [KNIME Analytics Platform logs credentials of configured proxy when used as an executor](https://agentprime.io/advisories/CVE-2026-115657.md)
  `CVE-2026-115657` · CVE record: KNIME KNIME Analytics Platform · CVSS 4.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Information disclosure
- [Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API](https://agentprime.io/advisories/CVE-2026-109935.md)
  `CVE-2026-109935` · CVE record: Unknown Otter Blocks · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Information disclosure
- [Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API](https://agentprime.io/advisories/CVE-2026-109934.md)
  `CVE-2026-109934` · CVE record: Unknown Otter Blocks · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Information disclosure
- [Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest](https://agentprime.io/advisories/CVE-2026-115449.md)
  `CVE-2026-115449` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 3.5 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters](https://agentprime.io/advisories/CVE-2026-115358.md)
  `CVE-2026-115358` · CVE record: openbao openbao · CVSS 2.0 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol](https://agentprime.io/advisories/CVE-2026-95712.md)
  `CVE-2026-95712` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing](https://agentprime.io/advisories/CVE-2026-79876.md)
  `CVE-2026-79876` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10](https://agentprime.io/advisories/CVE-2026-79871.md)
  `CVE-2026-79871` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79853.md)
  `CVE-2026-79853` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)](https://agentprime.io/advisories/CVE-2026-114606.md)
  `CVE-2026-114606` · CVE record: jgraph drawio-desktop · CVSS 5.6 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal, Information disclosure
- [Workflow names may be leaked to unauthenticated users in KNIME Business Hub](https://agentprime.io/advisories/CVE-2026-115496.md)
  `CVE-2026-115496` · CVE record: KNIME KNIME Business Hub · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Devolutions Server](https://agentprime.io/advisories/CVE-2026-114485.md)
  `CVE-2026-114485` · CVE record: Devolutions Server · CVSS 4.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens](https://agentprime.io/advisories/CVE-2026-115400.md)
  `CVE-2026-115400` · CVE record: crawlseo crawlseo · CVSS 6.7 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [Goose: goose: shell history and environment leak via terminal integration](https://agentprime.io/advisories/CVE-2026-111079.md)
  `CVE-2026-111079` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 1 more · CVSS 7.4 High · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint](https://agentprime.io/advisories/CVE-2026-114348.md)
  `CVE-2026-114348` · CVE record: webpack-dev-server webpack-dev-server · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure, CWE-1289
- [WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-114195.md)
  `CVE-2026-114195` · CVE record: WP Desk ShopMagic · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File](https://agentprime.io/advisories/CVE-2026-96293.md)
  `CVE-2026-96293` · CVE record: WatchGuard WatchGuard Agent · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure, Broken access control
- [NewType Infortech｜NT OneAPP - Exposure of Sensitive Information](https://agentprime.io/advisories/CVE-2026-114223.md)
  `CVE-2026-114223` · CVE record: NewType Infortech NT OneAPP · CVSS 6.7 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri](https://agentprime.io/advisories/CVE-2026-114657.md)
  `CVE-2026-114657` · CVE record: getgrav grav · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128](https://agentprime.io/advisories/CVE-2026-16648.md)
  `CVE-2026-16648` · CVE record: Drupal Mailer Plus Log · CVSS 3.8 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149](https://agentprime.io/advisories/CVE-2026-87951.md)
  `CVE-2026-87951` · CVE record: Drupal SAML SSO - Service Provider · CVSS 3.8 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [massCodeIO massCode Local HTTP Service index.ts information disclosure](https://agentprime.io/advisories/CVE-2026-114574.md)
  `CVE-2026-114574` · CVE record: massCodeIO massCode · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure, Broken access control
- [Insertion of Sensitive Information Into Sent Data in GitLab](https://agentprime.io/advisories/CVE-2026-105777.md)
  `CVE-2026-105777` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Files or Directories Accessible to External Parties in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76531.md)
  `CVE-2026-76531` · CVE record: Splunk Splunk SOAR · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Information Disclosure through REST API Authentication in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76406.md)
  `CVE-2026-76406` · CVE record: Splunk Splunk SOAR · CVSS 5.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76307.md)
  `CVE-2026-76307` · CVE record: Splunk Splunk SOAR · CVSS 7.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Information Disclosure through REST API Query Filters in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76306.md)
  `CVE-2026-76306` · CVE record: Splunk Splunk SOAR · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Vitest: Servers misapply \`server.fs.deny\`, serving \`.env\`, private keys, \`.git\`, and the API token file](https://agentprime.io/advisories/GHSA-p458-7748-mcp3.md)
  `GHSA-p458-7748-mcp3`, `CVE-2026-112948` · npm `vite-plus` and 2 more: affected `>=1.0.0-rc.0, <1.3.0`, fixed in `1.3.0` · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [ApostropheCMS: Exposure of Sensitive Information via predictable export filenames](https://agentprime.io/advisories/GHSA-5gc8-frw3-3vqm.md)
  `GHSA-5gc8-frw3-3vqm`, `CVE-2026-112953` · npm `@apostrophecms/import-export`: affected `<3.7.1`, fixed in `3.7.1` · CVSS 6.0 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user](https://agentprime.io/advisories/GHSA-f66c-mpj2-3r8h.md)
  `GHSA-f66c-mpj2-3r8h`, `CVE-2026-112952` · npm `apostrophe`: affected `<4.34.0`, fixed in `4.34.0` · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API](https://agentprime.io/advisories/GHSA-rqgm-cfrp-4hx8.md)
  `GHSA-rqgm-cfrp-4hx8`, `CVE-2026-112954` · npm `apostrophe`: affected `<4.34.0`, fixed in `4.34.0` · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Vite: First 4 bytes of files outside of \`server.fs\` setting is exposed by \`?vite-wasm-instance\`](https://agentprime.io/advisories/GHSA-vfpm-58rq-9qcg.md)
  `GHSA-vfpm-58rq-9qcg`, `CVE-2026-112947` · npm `vite` and 1 more: affected `>=8.2.0, <8.2.4 || >=8.3.0, <8.3.3`, fixed in `8.2.4`, `8.3.3` · CVSS 6.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal, Information disclosure
- [Slack Morphism verifier errors disclose valid HMACs in the logs](https://agentprime.io/advisories/GHSA-26w4-8w32-4x3v.md)
  `GHSA-26w4-8w32-4x3v`, `CVE-2026-113799` · crates.io `slack-morphism`: affected `>=1.0.0, <2.28.0`, fixed in `2.28.0` · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Cisco Expressway Series Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-76435.md)
  `CVE-2026-76435` · CVE record: Cisco Cisco TelePresence Video Communication Server (VCS) Expressway · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Insertion of Sensitive Information into Log File in hMailServer](https://agentprime.io/advisories/CVE-2026-114471.md)
  `CVE-2026-114471` · CVE record: Progressive Robot Ltd hMailServer · CVSS 4.7 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads](https://agentprime.io/advisories/CVE-2026-114400.md)
  `CVE-2026-114400` · CVE record: polonel trudesk · CVSS 8.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action](https://agentprime.io/advisories/CVE-2026-92999.md)
  `CVE-2026-92999` · CVE record: Unknown Click n Chat (Chat Widget Integration) · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure](https://agentprime.io/advisories/CVE-2026-111956.md)
  `CVE-2026-111956` · CVE record: Unknown WholesaleX · CVSS 5.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter](https://agentprime.io/advisories/CVE-2026-108073.md)
  `CVE-2026-108073` · CVE record: Unknown SureCart · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure](https://agentprime.io/advisories/CVE-2026-105999.md)
  `CVE-2026-105999` · CVE record: Unknown Booking Package · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint](https://agentprime.io/advisories/CVE-2026-114064.md)
  `CVE-2026-114064` · CVE record: grokability snipe-it · CVSS 5.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure

Newest: <https://agentprime.io/advisories/tag/info-disclosure.md>
Older: <https://agentprime.io/advisories/tag/info-disclosure.md?cursor=WyIyMDI2LTEwLTIxVDAwOjM2OjM3LjUyODAwMFoiLCJDVkUtMjAyNi0xMTQwNjQiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=info-disclosure&cursor=WyIyMDI2LTEwLTI2VDA4OjQxOjI2LjQ1NzAwMFoiLCJDVkUtMjAyNi04Mjk0MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/info-disclosure/?cursor=WyIyMDI2LTEwLTI2VDA4OjQxOjI2LjQ1NzAwMFoiLCJDVkUtMjAyNi04Mjk0MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.