# Information disclosure.

Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation](https://agentprime.io/advisories/CVE-2026-119331.md)
  `CVE-2026-119331` · CVE record: LadybirdBrowser ladybird · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure, CWE-346
- [WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-116861.md)
  `CVE-2026-116861` · CVE record: wpdesk Flexible Chat · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure
- [WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-115947.md)
  `CVE-2026-115947` · CVE record: RealMag777 HUSKY · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure
- [Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java](https://agentprime.io/advisories/CVE-2026-119117.md)
  `CVE-2026-119117` · CVE record: AWS amazon-kinesis-producer · CVSS 8.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure, CWE-214
- [Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf\[\<mapped_field>\]' Parameter via {get_user} Template Tag Injection](https://agentprime.io/advisories/CVE-2026-110305.md)
  `CVE-2026-110305` · CVE record: hwk-fr Advanced Custom Fields: Extended · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure
- [Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run](https://agentprime.io/advisories/CVE-2026-119290.md)
  `CVE-2026-119290` · CVE record: zuke-build zuke · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure
- [charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories](https://agentprime.io/advisories/GHSA-fgxm-5hvv-x4vh.md)
  `GHSA-fgxm-5hvv-x4vh`, `GO-2026-6892` · Go `github.com/charmbracelet/soft-serve`: affected `>=0.5.0, <0.12.3`, fixed in `0.12.3` · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure, Broken access control
- [SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount](https://agentprime.io/advisories/CVE-2026-61730.md)
  `CVE-2026-61730` · CVE record: socfortress CoPilot · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure, Authentication bypass, Hard-coded credentials
- [SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover](https://agentprime.io/advisories/CVE-2026-61728.md)
  `CVE-2026-61728` · CVE record: socfortress CoPilot · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS), Information disclosure
- [Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses](https://agentprime.io/advisories/CVE-2026-119570.md)
  `CVE-2026-119570` · CVE record: parse-community parse-server · CVSS 2.3 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure
- [Plausible Analytics through 3.2.1 Site Takeover via Exposed Invitation IDs](https://agentprime.io/advisories/CVE-2026-119564.md)
  `CVE-2026-119564` · CVE record: Plausible Plausible Analytics · CVSS 6.0 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure
- [Display of information in the Forocoches comments editor](https://agentprime.io/advisories/CVE-2026-14467.md)
  `CVE-2026-14467` · CVE record: Forocoches Forocoches comments editor · CVSS 8.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure
- [Cloud Controller exposes secrets in audit log](https://agentprime.io/advisories/CVE-2026-59388.md)
  `CVE-2026-59388` · CVE record: Cloud Foundry Foundation CAPI (Cloud Foundry Controller) and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure
- [BuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure](https://agentprime.io/advisories/CVE-2026-118100.md)
  `CVE-2026-118100` · CVE record: Unknown BuddyForms · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure
- [Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer](https://agentprime.io/advisories/CVE-2026-114444.md)
  `CVE-2026-114444` · CVE record: Unknown Security Plugin, Firewall & Malware Scanner with Auto Removal · CVSS 4.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure
- [Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207](https://agentprime.io/advisories/CVE-2026-107268.md)
  `CVE-2026-107268` · CVE record: Drupal Two Factor Authentication - TFA / Passwordless Login · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure
- [AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271](https://agentprime.io/advisories/CVE-2026-118551.md)
  `CVE-2026-118551` · CVE record: Drupal AI (Artificial Intelligence) · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure
- [Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291](https://agentprime.io/advisories/CVE-2026-118568.md)
  `CVE-2026-118568` · CVE record: Drupal Content Sync (content-sync.io) · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure
- [@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY](https://agentprime.io/advisories/GHSA-q344-5v34-gm84.md)
  `GHSA-q344-5v34-gm84`, `CVE-2026-62264` · npm `@sylphx/pdf-reader-mcp`: affected `>=2.2.0, <3.0.1`, fixed in `3.0.1` · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure, Authentication bypass
- [Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields](https://agentprime.io/advisories/CVE-2026-119125.md)
  `CVE-2026-119125` · CVE record: parse-community parse-server · CVSS 2.3 Low · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90861.md)
  `CVE-2026-90861` · CVE record: Progress Software WS_FTP Server · CVSS 6.6 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Hard-coded credentials, Information disclosure
- [WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-118083.md)
  `CVE-2026-118083` · CVE record: Themeum WP Crowdfunding · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-77817.md)
  `CVE-2026-77817` · CVE record: IBM Langflow OSS · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-110200.md)
  `CVE-2026-110200` · CVE record: IBM Langflow OSS · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-48200.md)
  `CVE-2026-48200` · CVE record: Barn2 Plugins Document Library Lite · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure](https://agentprime.io/advisories/CVE-2026-115711.md)
  `CVE-2026-115711` · CVE record: Elastic Elastic Cloud Enterprise · CVSS 6.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-115707.md)
  `CVE-2026-115707` · CVE record: Elastic Elastic Cloud Enterprise · CVSS 6.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [System Account Credential Disclosure in BMC ITSM](https://agentprime.io/advisories/CVE-2026-113693.md)
  `CVE-2026-113693` · CVE record: BMC BMC IT Service Management Suite · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [Insecure storage of sensitive information in Yamaha Corporation NWR100](https://agentprime.io/advisories/CVE-2026-109822.md)
  `CVE-2026-109822` · CVE record: Yamaha Corporation NWR100 · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter](https://agentprime.io/advisories/CVE-2026-92086.md)
  `CVE-2026-92086` · CVE record: websoudan MW WP Form · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})](https://agentprime.io/advisories/CVE-2026-91153.md)
  `CVE-2026-91153` · CVE record: wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration](https://agentprime.io/advisories/CVE-2026-117688.md)
  `CVE-2026-117688` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure](https://agentprime.io/advisories/CVE-2026-114270.md)
  `CVE-2026-114270` · CVE record: Unknown GeoDirectory · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure](https://agentprime.io/advisories/CVE-2026-108686.md)
  `CVE-2026-108686` · CVE record: Unknown WP Post Author · CVSS 3.7 Low · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure](https://agentprime.io/advisories/CVE-2026-78396.md)
  `CVE-2026-78396` · CVE record: Unknown Link Library · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure](https://agentprime.io/advisories/CVE-2026-115282.md)
  `CVE-2026-115282` · CVE record: Unknown Recipe Card Blocks Lite · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Frangoteam](https://agentprime.io/advisories/CVE-2026-40063.md)
  `CVE-2026-40063` · CVE record: frangoteam Frangoteam · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [Information disclosure in canva ortto](https://agentprime.io/advisories/CVE-2026-114173.md)
  `CVE-2026-114173` · CVE record: canva ortto · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure
- [maotoumao MusicFreeDesktop Request Forwarder information disclosure](https://agentprime.io/advisories/CVE-2026-118578.md)
  `CVE-2026-118578` · CVE record: maotoumao MusicFreeDesktop · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure, Broken access control
- [Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (\_build_session_scope)](https://agentprime.io/advisories/GHSA-5324-3w58-qpp2.md)
  `GHSA-5324-3w58-qpp2`, `CVE-2026-116575` · npm `mem0ai` and 1 more: affected `<3.1.6`, fixed in `3.1.6` · CVSS 6.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure, Broken access control
- [LangGraph CLI prints the registry push token in \`langgraph deploy --verbose\` output](https://agentprime.io/advisories/GHSA-8prr-f582-jqq3.md)
  `GHSA-8prr-f582-jqq3`, `CVE-2026-115885` · PyPI `langgraph-cli`: affected `>=0.4.15, <0.4.32`, fixed in `0.4.32` · CVSS 4.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [filelock: ReadWriteLock follows a symlink at the lock path into SQLite](https://agentprime.io/advisories/GHSA-j8f7-rjxc-mr56.md)
  `GHSA-j8f7-rjxc-mr56`, `CVE-2026-112936` · PyPI `filelock`: affected `>=3.20.4, <4.0.9`, fixed in `4.0.9` · CVSS 6.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal, Information disclosure
- [GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller](https://agentprime.io/advisories/GHSA-mp66-8ww2-pcwm.md)
  `GHSA-mp66-8ww2-pcwm`, `CVE-2026-118666` · npm `@graphql-tools/executor-legacy-ws`: affected `<1.1.36`, fixed in `1.1.36` · CVSS 6.0 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)](https://agentprime.io/advisories/GHSA-473q-m89c-ghf8.md)
  `GHSA-473q-m89c-ghf8` · NuGet `MySqlConnector`: affected `<2.6.1`, fixed in `2.6.1` · CVSS 4.0, no score published · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS](https://agentprime.io/advisories/CVE-2026-63190.md)
  `CVE-2026-63190` · CVE record: fearlessgeekmedia FearlessCMS · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal, Cross-site scripting (XSS), Information disclosure, Authentication bypass
- [n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data](https://agentprime.io/advisories/CVE-2026-118647.md)
  `CVE-2026-118647` · CVE record: n8n-io n8n · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data](https://agentprime.io/advisories/CVE-2026-118643.md)
  `CVE-2026-118643` · CVE record: n8n-io n8n · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule](https://agentprime.io/advisories/CVE-2026-105617.md)
  `CVE-2026-105617` · CVE record: DALIBO PostgreSQL Anonymizer · CVSS 5.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting](https://agentprime.io/advisories/CVE-2026-105616.md)
  `CVE-2026-105616` · CVE record: DALIBO PostgreSQL Anonymizer · CVSS 5.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors](https://agentprime.io/advisories/CVE-2026-79656.md)
  `CVE-2026-79656` · CVE record: Grafana Grafana OSS and 1 more · CVSS 6.0 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint](https://agentprime.io/advisories/CVE-2026-116593.md)
  `CVE-2026-116593` · CVE record: Apache Software Foundation Apache Kafka · CVSS 8.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-115591.md)
  `CVE-2026-115591` · CVE record: Supsystic Contact Form by Supsystic · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [HCL BigFix AEX is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67080.md)
  `CVE-2026-67080` · CVE record: HCL Software BigFix AEX · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure, CWE-391, CWE-755
- [HCL BigFix AEX is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67073.md)
  `CVE-2026-67073` · CVE record: HCL Software BigFix AEX · CVSS 8.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS), Broken access control, Unrestricted file upload, Information disclosure
- [GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode](https://agentprime.io/advisories/CVE-2026-113494.md)
  `CVE-2026-113494` · CVE record: Unknown GeoDirectory · CVSS 2.7 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler](https://agentprime.io/advisories/CVE-2026-110509.md)
  `CVE-2026-110509` · CVE record: Unknown Essential Addons for Elementor · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments](https://agentprime.io/advisories/CVE-2026-110507.md)
  `CVE-2026-110507` · CVE record: Unknown Page Builder by SiteOrigin · CVSS 2.7 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent](https://agentprime.io/advisories/CVE-2026-110292.md)
  `CVE-2026-110292` · CVE record: Unknown PayPlug for WooCommerce (Official) · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content](https://agentprime.io/advisories/CVE-2026-107100.md)
  `CVE-2026-107100` · CVE record: Unknown Royal Addons for Elementor · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure](https://agentprime.io/advisories/CVE-2026-103372.md)
  `CVE-2026-103372` · CVE record: Unknown Payconiq · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure

Newest: <https://agentprime.io/advisories/tag/info-disclosure.md>
Older: <https://agentprime.io/advisories/tag/info-disclosure.md?cursor=WyIyMDI2LTEwLTI4VDA2OjAwOjIwLjIyNDAwMFoiLCJDVkUtMjAyNi0xMDMzNzIiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=info-disclosure&cursor=WyIyMDI2LTEwLTMwVDIwOjU1OjU2Ljk5NTAwMFoiLCJDVkUtMjAyNi02Mjk3OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/info-disclosure/?cursor=WyIyMDI2LTEwLTMwVDIwOjU1OjU2Ljk5NTAwMFoiLCJDVkUtMjAyNi02Mjk3OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.