# Information disclosure. Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python](https://agentprime.io/advisories/CVE-2026-115522.md) `CVE-2026-115522` · CVE record: Google Agent Development Kit (ADK) for Python · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure - [a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure](https://agentprime.io/advisories/CVE-2026-118272.md) `CVE-2026-118272` · CVE record: a2ui-project a2ui · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-118338.md) `CVE-2026-118338` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-118312.md) `CVE-2026-118312` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [MLflow CrewAI autologging records LLM provider API keys in logged trace spans](https://agentprime.io/advisories/GHSA-j7qq-vr8c-xvw3.md) `GHSA-j7qq-vr8c-xvw3`, `CVE-2026-116691` · PyPI `mlflow`: affected `>=2.19.0, <3.17.0`, fixed in `3.17.0` · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies](https://agentprime.io/advisories/GHSA-5h93-6whr-6q8j.md) `GHSA-5h93-6whr-6q8j`, `CVE-2026-116685` · PyPI `mcp`: affected `>=1.8.0, <1.30.0 || >=2.0.0, <2.2.0`, fixed in `1.30.0`, `2.2.0` · CVSS 5.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Bypass of remote UNC path restriction in mailbox: URLs](https://agentprime.io/advisories/CVE-2026-118176.md) `CVE-2026-118176` · CVE record: Mozilla Thunderbird · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Content of other messages could be included when replying to a crafted message](https://agentprime.io/advisories/CVE-2026-118175.md) `CVE-2026-118175` · CVE record: Mozilla Thunderbird · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Tanium addressed an information disclosure vulnerability in Tanium Server.](https://agentprime.io/advisories/CVE-2026-108316.md) `CVE-2026-108316` · CVE record: Tanium Tanium Server · CVSS 4.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.](https://agentprime.io/advisories/CVE-2026-108325.md) `CVE-2026-108325` · CVE record: Tanium Reputation · CVSS 6.6 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response.](https://agentprime.io/advisories/CVE-2026-108328.md) `CVE-2026-108328` · CVE record: Tanium Threat Response · CVSS 4.2 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Information disclosure in Nextcloud Tables](https://agentprime.io/advisories/CVE-2026-82983.md) `CVE-2026-82983` · CVE record: Nextcloud Tables · CVSS 3.3 Low · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [rustls: ECH rejection can expose buffered application data to authenticated outer server before \`ech_required\` alert](https://agentprime.io/advisories/GHSA-vp88-798v-h67f.md) `GHSA-vp88-798v-h67f`, `RUSTSEC-2026-0347` · crates.io `rustls`: affected `>=0.23.44, <0.23.46 || >=0.24.0-dev.1, <0.24.0-dev.2`, fixed in `0.23.46`, `0.24.0-dev.2` · CVSS 2.3 Low · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Host filesystem path disclosure via DNS rebinding](https://agentprime.io/advisories/EEF-CVE-2026-109823.md) `EEF-CVE-2026-109823`, `CVE-2026-109823` · Hex `tidewave`: affected `>=0.8.0, <0.9.2`, fixed in `0.9.2` · CVSS 2.3 Low · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [GitPython: arbitrary file read via attacker-controlled branch name in \`Head.checkout()\` (incomplete fix of CVE-2026-78679)](https://agentprime.io/advisories/GHSA-23mf-xhv8-69c2.md) `GHSA-23mf-xhv8-69c2`, `CVE-2026-110859` · PyPI `gitpython`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Path traversal, Command injection, Information disclosure - [GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name](https://agentprime.io/advisories/GHSA-fx3j-rwgx-fr94.md) `GHSA-fx3j-rwgx-fr94`, `CVE-2026-110855` · PyPI `gitpython`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback](https://agentprime.io/advisories/CVE-2026-117604.md) `CVE-2026-117604` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Information disclosure in the Networking: DNS component](https://agentprime.io/advisories/CVE-2026-118003.md) `CVE-2026-118003` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Information disclosure due to race condition in the Networking component](https://agentprime.io/advisories/CVE-2026-118002.md) `CVE-2026-118002` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Information disclosure in the Networking: HTTP component](https://agentprime.io/advisories/CVE-2026-118000.md) `CVE-2026-118000` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Information disclosure in the CSS Parsing and Computation component](https://agentprime.io/advisories/CVE-2026-117992.md) `CVE-2026-117992` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Docker Desktop logs can expose stored third-party credentials](https://agentprime.io/advisories/CVE-2026-114409.md) `CVE-2026-114409` · CVE record: Docker Docker Desktop · CVSS 5.7 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Sensitive information in log files in Octopus Deploy Octopus Server](https://agentprime.io/advisories/CVE-2026-117341.md) `CVE-2026-117341` · CVE record: Octopus Deploy Octopus Server · CVSS 7.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability](https://agentprime.io/advisories/CVE-2026-65210.md) `CVE-2026-65210` · CVE record: SMCI MBD-X12SPI · CVSS 4.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [An issue in Shirt Pocket's SuperDuper!](https://agentprime.io/advisories/CVE-2026-107067.md) `CVE-2026-107067` · CVE record · CVSS 6.2 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure - [OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query](https://agentprime.io/advisories/CVE-2026-116819.md) `CVE-2026-116819` · CVE record: Openpanel-dev openpanel · CVSS 8.4 High · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs](https://agentprime.io/advisories/CVE-2026-116814.md) `CVE-2026-116814` · CVE record: Openpanel-dev openpanel · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list](https://agentprime.io/advisories/CVE-2026-116805.md) `CVE-2026-116805` · CVE record: Openpanel-dev openpanel · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [TOTOLINK A950RG global.so getLanguageCfg information disclosure](https://agentprime.io/advisories/CVE-2026-116507.md) `CVE-2026-116507` · CVE record: TOTOLINK A950RG · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure, Broken access control - [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-112704.md) `CVE-2026-112704` · CVE record: Apple macOS · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-113908.md) `CVE-2026-113908` · CVE record: Apple iOS and iPadOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Sensitive information in log files in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-113898.md) `CVE-2026-113898` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 3.3 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-112441.md) `CVE-2026-112441` · CVE record: Apple macOS · CVSS 3.3 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-112617.md) `CVE-2026-112617` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-86978.md) `CVE-2026-86978` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 3.3 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Sensitive information in log files in Apple macOS](https://agentprime.io/advisories/CVE-2026-84528.md) `CVE-2026-84528` · CVE record: Apple macOS · CVSS 3.3 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-86923.md) `CVE-2026-86923` · CVE record: Apple macOS · CVSS 3.3 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-84498.md) `CVE-2026-84498` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-112575.md) `CVE-2026-112575` · CVE record: Apple macOS · CVSS 6.2 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112665.md) `CVE-2026-112665` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 3.3 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-112537.md) `CVE-2026-112537` · CVE record: Apple macOS · CVSS 4.0 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112628.md) `CVE-2026-112628` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112500.md) `CVE-2026-112500` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Sensitive information in log files in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112432.md) `CVE-2026-112432` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-112577.md) `CVE-2026-112577` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-86931.md) `CVE-2026-86931` · CVE record: Apple macOS · CVSS 6.2 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-112707.md) `CVE-2026-112707` · CVE record: Apple iOS and iPadOS · CVSS 3.3 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose](https://agentprime.io/advisories/GHSA-vwvr-f994-6j9j.md) `GHSA-vwvr-f994-6j9j`, `CVE-2026-65626`, `EEF-CVE-2026-65626` · Hex `jose`: affected `>=1.3.0, <1.11.13`, fixed in `1.11.13` · CVSS 5.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [a2aproject a2a-java JSON-RPC Error getMessage information exposure](https://agentprime.io/advisories/CVE-2026-116479.md) `CVE-2026-116479` · CVE record: a2aproject a2a-java · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure](https://agentprime.io/advisories/CVE-2026-116478.md) `CVE-2026-116478` · CVE record: a2aproject a2a-go · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure](https://agentprime.io/advisories/CVE-2026-116477.md) `CVE-2026-116477` · CVE record: a2aproject a2a-dotnet · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [OctoPrint API Key settings.py getSettings information disclosure](https://agentprime.io/advisories/CVE-2013-10077.md) `CVE-2013-10077` · CVE record: OctoPrint · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure, Broken access control - [Cleartext Storage of Sensitive Information in boneIO](https://agentprime.io/advisories/CVE-2026-77054.md) `CVE-2026-77054` · CVE record: boneIO boneIO · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Kameleo Local API user-info information disclosure](https://agentprime.io/advisories/CVE-2026-116284.md) `CVE-2026-116284` · CVE record: Kameleo · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure, Broken access control - [Kameleo Local API profiles information disclosure](https://agentprime.io/advisories/CVE-2026-116283.md) `CVE-2026-116283` · CVE record: Kameleo · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure, Broken access control - [Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure](https://agentprime.io/advisories/CVE-2026-116282.md) `CVE-2026-116282` · CVE record: Kameleo · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure, Broken access control - [Kameleo Profile Controller t.cs ListProfiles information disclosure](https://agentprime.io/advisories/CVE-2026-116281.md) `CVE-2026-116281` · CVE record: Kameleo · CVSS 4.8 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure, Broken access control - [WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-115594.md) `CVE-2026-115594` · CVE record: David Lingren Media LIbrary Assistant · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Cleartext Storage of Windows Service Account Password in BRAIN2 Setup Log Files](https://agentprime.io/advisories/CVE-2026-112250.md) `CVE-2026-112250` · CVE record: Bizerba SE & Co. KG BRAIN2 · CVSS 4.4 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure - [Out-of-Bounds Read via Unchecked Length Values](https://agentprime.io/advisories/CVE-2026-82943.md) `CVE-2026-82943` · CVE record: RT-Labs AB SOEM · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption, Information disclosure, CWE-195 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .