# Information disclosure. Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure](https://agentprime.io/advisories/GHSA-x32g-jvvm-4725.md) `GHSA-x32g-jvvm-4725`, `CVE-2026-111762` · Maven `org.a2aproject.sdk:a2a-java-sdk-transport-rest`: affected `<1.3.0.Final`, fixed in `1.3.0.Final` · CVSS 5.7 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-113331.md) `CVE-2026-113331` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-113314.md) `CVE-2026-113314` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113085.md) `CVE-2026-113085` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113288.md) `CVE-2026-113288` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113268.md) `CVE-2026-113268` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113180.md) `CVE-2026-113180` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-113167.md) `CVE-2026-113167` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-113300.md) `CVE-2026-113300` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113201.md) `CVE-2026-113201` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-113056.md) `CVE-2026-113056` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113091.md) `CVE-2026-113091` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-113203.md) `CVE-2026-113203` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-113197.md) `CVE-2026-113197` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-112997.md) `CVE-2026-112997` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113243.md) `CVE-2026-113243` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113277.md) `CVE-2026-113277` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113049.md) `CVE-2026-113049` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113128.md) `CVE-2026-113128` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Resource exposure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113126.md) `CVE-2026-113126` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Resource exposure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113328.md) `CVE-2026-113328` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-112995.md) `CVE-2026-112995` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-112992.md) `CVE-2026-112992` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113208.md) `CVE-2026-113208` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-113057.md) `CVE-2026-113057` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113176.md) `CVE-2026-113176` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113000.md) `CVE-2026-113000` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)](https://agentprime.io/advisories/GHSA-jfgx-762w-99vr.md) `GHSA-jfgx-762w-99vr`, `CVE-2026-111753` · npm `@angular/common`: affected `<=19.2.25 || >=20.0.0, <20.3.34 || >=21.0.0, <21.0.3`, fixed in `20.3.34`, `21.0.3` · CVSS 5.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Authorization: Negotiate sent to foreign origin](https://agentprime.io/advisories/CVE-2026-94265.md) `CVE-2026-94265` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [TFTP direction confusion](https://agentprime.io/advisories/CVE-2026-92389.md) `CVE-2026-92389` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [HSTS response erases persisted entries](https://agentprime.io/advisories/CVE-2026-87863.md) `CVE-2026-87863` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [HSTS cache import drops longer-lived child](https://agentprime.io/advisories/CVE-2026-87862.md) `CVE-2026-87862` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [cross-origin reuse of a Negotiate connection](https://agentprime.io/advisories/CVE-2026-87861.md) `CVE-2026-87861` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [auto client cert connection reuse mixup](https://agentprime.io/advisories/CVE-2026-86415.md) `CVE-2026-86415` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [leaking host credentials to HTTP proxy](https://agentprime.io/advisories/CVE-2026-86414.md) `CVE-2026-86414` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Negotiate credentials sent to redirected origin](https://agentprime.io/advisories/CVE-2026-86413.md) `CVE-2026-86413` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [stale SigV4 headers sent unintended](https://agentprime.io/advisories/CVE-2026-86409.md) `CVE-2026-86409` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies](https://agentprime.io/advisories/GHSA-6prh-2h8m-c8cw.md) `GHSA-6prh-2h8m-c8cw`, `CVE-2026-111769` · npm `@modelcontextprotocol/client` and 1 more: affected `>=2.0.0, <2.3.0`, fixed in `2.3.0` · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)](https://agentprime.io/advisories/GHSA-hhph-8536-gfq5.md) `GHSA-hhph-8536-gfq5`, `CVE-2026-113652` · npm `uploadfs`: affected `>=1.25.0, <1.28.0`, fixed in `1.28.0` · CVSS 5.6 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure, Hard-coded credentials - [ApostropheCMS: :\_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)](https://agentprime.io/advisories/GHSA-gqh3-7856-rjjg.md) `GHSA-gqh3-7856-rjjg`, `CVE-2026-113668` · npm `apostrophe`: affected `<4.33.0`, fixed in `4.33.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure, Broken access control - [follow-redirects array-form headers bypass cross-origin credential stripping](https://agentprime.io/advisories/GHSA-q3jh-wrc6-jgq8.md) `GHSA-q3jh-wrc6-jgq8`, `CVE-2026-111756` · npm `follow-redirects`: affected `>=1.16.0, <1.16.1`, fixed in `1.16.1` · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure, CWE-212 - [follow-redirects sensitiveHeaders regex escaping can expose credential headers](https://agentprime.io/advisories/GHSA-8r9p-f939-6h3c.md) `GHSA-8r9p-f939-6h3c`, `CVE-2026-111755` · npm `follow-redirects`: affected `>=1.16.0, <1.16.1`, fixed in `1.16.1` · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure, CWE-185 - [SolarWinds Patch Manager Sensitive Information Exposure Vulnerability](https://agentprime.io/advisories/CVE-2026-28331.md) `CVE-2026-28331` · CVE record: SolarWinds Patch Manager · CVSS 4.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs](https://agentprime.io/advisories/CVE-2026-107755.md) `CVE-2026-107755` · CVE record: Apache Software Foundation Apache CouchDB · CVSS 6.0 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Apache Cocoon: Unauthenticated access to diagnostic interfaces](https://agentprime.io/advisories/CVE-2026-108089.md) `CVE-2026-108089` · CVE record: Apache Software Foundation Apache Cocoon · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [TYPO3-EXT-SA-2026-035: Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)](https://agentprime.io/advisories/PKSA-kk39-vqqg-74n6.md) `PKSA-kk39-vqqg-74n6`, `CVE-2026-113459` · Packagist `nitsan/ns-t3ai`: affected `<14.0.2`, fixed in `14.0.2` · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers](https://agentprime.io/advisories/CVE-2026-96903.md) `CVE-2026-96903` · CVE record: Unknown Easy Property Listings · CVSS 4.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API](https://agentprime.io/advisories/CVE-2026-96902.md) `CVE-2026-96902` · CVE record: Unknown Easy Property Listings · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-86979.md) `CVE-2026-86979` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-86940.md) `CVE-2026-86940` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-86914.md) `CVE-2026-86914` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure - [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-65379.md) `CVE-2026-65379` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure, Broken access control - [Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header](https://agentprime.io/advisories/CVE-2026-111946.md) `CVE-2026-111946` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure - [Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-\*@ Directives](https://agentprime.io/advisories/CVE-2026-112781.md) `CVE-2026-112781` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure - [Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters](https://agentprime.io/advisories/CVE-2026-112771.md) `CVE-2026-112771` · CVE record: craftcms cms · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure - [IBM Concert Software Information Disclosure](https://agentprime.io/advisories/CVE-2026-3628.md) `CVE-2026-3628` · CVE record: IBM Concert · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure - [Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery](https://agentprime.io/advisories/CVE-2025-13591.md) `CVE-2025-13591` · CVE record: WSO2 WSO2 Identity Server and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure - [Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover](https://agentprime.io/advisories/CVE-2025-10149.md) `CVE-2025-10149` · CVE record: WSO2 WSO2 Identity Server as Key Manager and 4 more · CVSS 8.2 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, CWE-281 - [Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials](https://agentprime.io/advisories/CVE-2025-7203.md) `CVE-2025-7203` · CVE record: WSO2 WSO2 Universal Gateway and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure - [Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables](https://agentprime.io/advisories/CVE-2026-107187.md) `CVE-2026-107187` · CVE record: Eptura Archibus · CVSS 8.5 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .