# Information disclosure. Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121059.md) `CVE-2026-121059` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121106.md) `CVE-2026-121106` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121099.md) `CVE-2026-121099` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121161.md) `CVE-2026-121161` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121105.md) `CVE-2026-121105` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-121038.md) `CVE-2026-121038` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Information disclosure in Devolutions Server](https://agentprime.io/advisories/CVE-2026-120716.md) `CVE-2026-120716` · CVE record: Devolutions Server · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Cleartext storage of sensitive information in Devolutions Server](https://agentprime.io/advisories/CVE-2026-120733.md) `CVE-2026-120733` · CVE record: Devolutions Server · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Headless CMS Plugin REST API post get_required_post_data information disclosure](https://agentprime.io/advisories/CVE-2026-121509.md) `CVE-2026-121509` · CVE record: Headless CMS Plugin · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure, Broken access control - [Authenticated Sensitive Information Disclosure in VIA](https://agentprime.io/advisories/CVE-2026-95729.md) `CVE-2026-95729` · CVE record: Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA) · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Rust Driver 3.9.1 exports CSFLE plaintext in \`db.query.text\` before encrypting the command](https://agentprime.io/advisories/CVE-2026-120673.md) `CVE-2026-120673` · CVE record: MongoDB Rust Driver · CVSS 6.8 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Logging Redactor: PII data in str/repr of non primitive objects was not being redacted](https://agentprime.io/advisories/CVE-2026-63417.md) `CVE-2026-63417` · CVE record: armurox loggingredactor · CVSS 8.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-114183.md) `CVE-2026-114183` · CVE record: WPVibes AnyWhere Elementor · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure](https://agentprime.io/advisories/CVE-2026-115293.md) `CVE-2026-115293` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Arc has unauthenticated application log disclosure via \`/api/v1/logs\`](https://agentprime.io/advisories/GHSA-m3qr-fvp4-78xj.md) `GHSA-m3qr-fvp4-78xj`, `GO-2026-6907` · Go `github.com/basekick-labs/arc`: affected `<0.0.0-20260615165136-bb7d9761ad98`, fixed in `0.0.0-20260615165136-bb7d9761ad98` · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure, Authentication bypass - [Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints](https://agentprime.io/advisories/CVE-2026-121587.md) `CVE-2026-121587` · CVE record: coollabsio coolify · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects](https://agentprime.io/advisories/CVE-2026-121554.md) `CVE-2026-121554` · CVE record: silkimen cordova-plugin-advanced-http · CVSS 8.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [CachingWebClient shares user-specific HTTP responses across users via the shared cache tier](https://agentprime.io/advisories/CVE-2026-118489.md) `CVE-2026-118489` · CVE record: Eclipse Foundation Eclipse Vert.x · CVSS 7.5 High · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure, CWE-524 - [Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook](https://agentprime.io/advisories/CVE-2026-121449.md) `CVE-2026-121449` · CVE record: Finsys dockhand · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php](https://agentprime.io/advisories/CVE-2026-121436.md) `CVE-2026-121436` · CVE record: froxlor froxlor · CVSS 8.6 High · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [LDAP Bind Password Exposure in AxxonNet ARP Agent Logs](https://agentprime.io/advisories/CVE-2026-121023.md) `CVE-2026-121023` · CVE record: AxxonSoft AxxonNet ARP Agent · CVSS 6.8 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [User and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration API](https://agentprime.io/advisories/CVE-2026-121020.md) `CVE-2026-121020` · CVE record: AxxonSoft Axxon One · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [weMail <= 2.1.6 - Editor+ API Key Disclosure](https://agentprime.io/advisories/CVE-2026-104648.md) `CVE-2026-104648` · CVE record: Unknown weMail · CVSS 4.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token](https://agentprime.io/advisories/CVE-2026-103379.md) `CVE-2026-103379` · CVE record: Unknown WATI Chat and Notification · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses](https://agentprime.io/advisories/CVE-2026-120971.md) `CVE-2026-120971` · CVE record: Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages](https://agentprime.io/advisories/CVE-2026-105770.md) `CVE-2026-105770` · CVE record: octo-sts app · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [EchoHS GeekezBrowser Public API status information disclosure](https://agentprime.io/advisories/CVE-2026-120503.md) `CVE-2026-120503` · CVE record: EchoHS GeekezBrowser · CVSS 4.8 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure, Broken access control - [Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy](https://agentprime.io/advisories/CVE-2026-88811.md) `CVE-2026-88811` · CVE record: SUSE Rancher · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure - [An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable src](https://agentprime.io/advisories/CVE-2026-120501.md) `CVE-2026-120501` · CVE record: redimp otterwiki · CVSS 6.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure - [Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1](https://agentprime.io/advisories/CVE-2026-102801.md) `CVE-2026-102801` · CVE record: regularlabs.com Users Anywhere (Free, Pro) extension for Joomla · CVSS 5.1 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure - [Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data](https://agentprime.io/advisories/CVE-2026-18800.md) `CVE-2026-18800` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 4.4 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure - [Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths](https://agentprime.io/advisories/CVE-2025-13647.md) `CVE-2025-13647` · CVE record: WSO2 WSO2 Identity Server and 4 more · CVSS 5.8 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure - [Information disclosure in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2026-101178.md) `CVE-2026-101178` · CVE record: Huawei HarmonyOS and 1 more · CVSS 6.6 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure - [Information disclosure in Huawei HarmonyOS](https://agentprime.io/advisories/CVE-2026-101181.md) `CVE-2026-101181` · CVE record: Huawei HarmonyOS · CVSS 5.5 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure - [Sensitive information in log files in MediaTek, Inc. MediaTek chipset](https://agentprime.io/advisories/CVE-2026-20592.md) `CVE-2026-20592` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 4.1 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure - [Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response](https://agentprime.io/advisories/CVE-2026-120310.md) `CVE-2026-120310` · CVE record: parse-community parse-server · CVSS 2.3 Low · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure - [samanhappy MCPHub passthroughHeaders.ts information disclosure](https://agentprime.io/advisories/CVE-2026-120323.md) `CVE-2026-120323` · CVE record: samanhappy MCPHub · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure, Broken access control - [Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader](https://agentprime.io/advisories/CVE-2026-84172.md) `CVE-2026-84172` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure - [ag-ui-protocol ag-ui HttpAgent http.ts information disclosure](https://agentprime.io/advisories/CVE-2026-120233.md) `CVE-2026-120233` · CVE record: ag-ui-protocol ag-ui · CVSS 6.9 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure, Broken access control - [Beta9 host filesystem exposure via volume path traversal](https://agentprime.io/advisories/CVE-2026-120308.md) `CVE-2026-120308` · CVE record: beam-cloud Beta9 gateway and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Path traversal, Information disclosure - [Gitea OAuth2 userinfo private group disclosure to public-only tokens](https://agentprime.io/advisories/CVE-2026-118394.md) `CVE-2026-118394` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure, Broken access control - [Gitea private issue disclosure through issue dependency timeline events](https://agentprime.io/advisories/CVE-2026-117649.md) `CVE-2026-117649` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure, Broken access control - [Gitea contribution heatmap private activity disclosure to public-only tokens](https://agentprime.io/advisories/CVE-2026-114199.md) `CVE-2026-114199` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure - [Gitea Actions task token private repository enumeration](https://agentprime.io/advisories/CVE-2026-112887.md) `CVE-2026-112887` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure, Broken access control - [MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure](https://agentprime.io/advisories/CVE-2026-118168.md) `CVE-2026-118168` · CVE record: Unknown MapPress · CVSS 5.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure - [Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure](https://agentprime.io/advisories/CVE-2026-107342.md) `CVE-2026-107342` · CVE record: Unknown Kali Forms — Contact Form & Drag-and-Drop Builder · CVSS 4.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure - [Presenton Desktop Authentication Middleware app_data information disclosure](https://agentprime.io/advisories/CVE-2026-120192.md) `CVE-2026-120192` · CVE record: Presenton · CVSS 6.9 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure, Broken access control - [Konflux-ci: github token plaintext exposure in ci/cd scripts](https://agentprime.io/advisories/CVE-2026-114217.md) `CVE-2026-114217` · CVE record · CVSS 8.6 High · Not analysed yet · Published 31 Oct 2026 · Tags: Information disclosure - [All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter](https://agentprime.io/advisories/CVE-2026-109367.md) `CVE-2026-109367` · CVE record: smub All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) · CVSS 5.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Information disclosure - [Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter](https://agentprime.io/advisories/CVE-2026-103915.md) `CVE-2026-103915` · CVE record: melograno Booking for Appointments and Events Calendar – Amelia · CVSS 5.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Information disclosure - [Seraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory](https://agentprime.io/advisories/CVE-2026-90960.md) `CVE-2026-90960` · CVE record: seraphinitesoft Seraphinite Accelerator · CVSS 5.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Information disclosure - [Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download](https://agentprime.io/advisories/CVE-2026-82214.md) `CVE-2026-82214` · CVE record: Unknown Quick Event Manager · CVSS 5.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Information disclosure - [All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure](https://agentprime.io/advisories/CVE-2026-118629.md) `CVE-2026-118629` · CVE record: Unknown All-in-One Video Gallery · CVSS 5.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Information disclosure - [Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Settings Page](https://agentprime.io/advisories/CVE-2026-110042.md) `CVE-2026-110042` · CVE record: Unknown Payment Forms for Paystack · CVSS 4.9 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Information disclosure - [Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs](https://agentprime.io/advisories/GHSA-wg5q-x4j9-qm54.md) `GHSA-wg5q-x4j9-qm54`, `CVE-2026-118759`, `GO-2026-6900` · Go `github.com/kubeflow/pipelines`: affected `<0.0.0-20260904182349-be4723e33727`, fixed in `0.0.0-20260904182349-be4723e33727` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure, Broken access control - [Nuxt dev server exposes generated appSecret through Vite file serving](https://agentprime.io/advisories/GHSA-3xf4-9g3c-4h4w.md) `GHSA-3xf4-9g3c-4h4w`, `CVE-2026-119201` · npm `@nuxt/vite-builder`: affected `>=4.6.0, <4.6.3`, fixed in `4.6.3` · CVSS 4.8 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure - [Nuxt dev server exposes private runtime config through the Nitro dev bundle](https://agentprime.io/advisories/GHSA-648h-gw55-m2g7.md) `GHSA-648h-gw55-m2g7`, `CVE-2026-119199` · npm `@nuxt/vite-builder`: affected `>=3.0.0, <4.6.3`, fixed in `4.6.3` · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure - [follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects](https://agentprime.io/advisories/GHSA-mrwp-f3q8-3g9p.md) `GHSA-mrwp-f3q8-3g9p`, `CVE-2026-116689` · npm `follow-redirects`: affected `>=1.16.0, <1.16.2`, fixed in `1.16.2` · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure - [Element Call exposes shared passwords in logs](https://agentprime.io/advisories/CVE-2026-62347.md) `CVE-2026-62347` · CVE record: element-hq element-call · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure - [jack: upstream error responses expose backend and peer credentials](https://agentprime.io/advisories/CVE-2026-62979.md) `CVE-2026-62979` · CVE record: roziscoding jack · CVSS 8.4 High · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .