Advisories · Weakness
Information disclosure.
Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.9 Medium
Webkul Aureus ERP composer.json insertion of sensitive information into debugging code
- Webkul Aureus ERP
- Information disclosure
- CWE-215
- CVSS 6.9 Medium
FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
- FOSSBilling
- Information disclosure
- Authentication bypass
- CVSS 6.9 Medium
FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists
- FOSSBilling
- Path traversal
- Information disclosure
- CVSS 6.9 Medium
ai-genius-automations octoally index.ts information disclosure
- ai-genius-automations octoally
- Information disclosure
- Broken access control
- CVSS 6.9 Medium
satya-vinay Events-Management-System project.sql file access
- satya-vinay Events-Management-System
- Broken access control
- Information disclosure
- CVSS 5.3 Medium
Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions
- Apache Software Foundation Apache Camel
- Information disclosure
- CVSS 5.5 Medium
Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default
- Apache Software Foundation Apache Camel
- Information disclosure
- CVSS 5.3 Medium
Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions
- Apache Software Foundation Apache Camel
- Information disclosure
- CVSS 7.5 High
Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets
- Apache Software Foundation Apache Camel
- Information disclosure
- CVSS 5.3 Medium
Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions
- Apache Software Foundation Apache Camel
- Information disclosure
- CVSS 5.3 Medium
Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions
- Apache Software Foundation Apache Camel
- Information disclosure
- CVSS 8.2 High
Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers
- Apache Software Foundation Apache Camel
- Information disclosure
- Code injection
- CVSS 5.9 Medium
Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure
- Apache Software Foundation Apache Camel
- Path traversal
- Information disclosure
- CVSS 7.5 High
Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
- Apache Software Foundation Apache Answer
- Information disclosure
- CVSS 5.3 Medium
MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
- MISP
- Information disclosure
- Broken access control
- CVSS 8.1 High
Apache Answer: API keys logged in plaintext during authentication
- Apache Software Foundation Apache Answer
- Information disclosure
- CVSS 7.1 High
MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
- MISP
- Information disclosure
- Broken access control
- CVSS 7.5 High
Apache Kylin: Potential unauthenticated job metadata replacement
- Apache Software Foundation Apache Kylin
- Information disclosure
- CVSS 5.3 Medium
MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
- MISP
- Information disclosure
- CVSS 6.9 Medium
Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure
- Dav-ee dairy-management-system
- Information disclosure
- Broken access control
- CVSS 5.3 Medium
FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
- FormFlow for GoHighLevel (GHL)
- Information disclosure
- CVSS 9.3 CriticalCritical · CVSS 9+
Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)
- Google SAM
- Information disclosure
- Authentication bypass
- CVSS 6.9 Medium
light0011 cms Uploadify check-exists.php file_exists file information disclosure
- light0011 cms
- Information disclosure
- CVSS 6.5 Medium
Gitea private profile information disclosure through POST request
- Gitea
- Information disclosure
- CVSS 4.3 Medium
Gitea draft release creation disclosing attachment metadata
- Gitea
- Information disclosure
- CVSS 4.8 Medium
Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage
- Soarkey StudentManagement
- Information disclosure
- CWE-310
- CVSS 4.3 Medium
Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions
- Modern Events Calendar Lite
- Information disclosure
- CVSS 5.3 Medium
Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
- coder
- Information disclosure
- CVSS 4.8 Medium
Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest
- coder
- Information disclosure
- CVSS 6.9 Medium
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API
- thorsten phpMyFAQ
- Information disclosure
- CVSS 7.5 High
WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability
- Gantry 5 Framework
- Information disclosure
- CVSS 6.5 Medium
ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection
- ThirstyAffiliates
- Information disclosure
- CVSS 5.3 Medium
PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check
- PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
- Information disclosure
- CVSS 3.7 Low
Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- Information disclosure
- CVSS 8.5 High
Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host
- arcane
- Information disclosure
- Hard-coded credentials
- CVSS 7.5 High
Apache Kylin: Broken Access Control in QuerySQLBlacklistController
- Apache Software Foundation Apache Kylin
- Information disclosure
- CVSS 7.5 High
Apache Kylin: JobController allows unauthorized cross-project manipulation
- Apache Software Foundation Apache Kylin
- Information disclosure
- CVSS 7.5 High
Apache Kylin: Unauthorized cross-project job discard
- Apache Software Foundation Apache Kylin
- Information disclosure
- CVSS 7.5 High
Apache Kylin: Unauthorized SQL execution to Spark SQL env
- Apache Software Foundation Apache Kylin
- Information disclosure
- CVSS 7.5 High
libIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileRead
- mz-automation libiec61850
- Memory corruption
- Information disclosure
- CVSS 4.3 Medium
Discourse Doc Categories: Doc category index refresh leaks private topic titles
- discourse-doc-categories
- Information disclosure
- CVSS 6.8 Medium
Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)
- open-zaak
- Information disclosure
- CVSS 7.5 High
Apache Kylin: Low-Privilege Config Exposure
- Apache Software Foundation Apache Kylin
- Information disclosure
- CVSS 5.3 Medium
MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key
- MAIO
- Information disclosure
- CVSS 4.3 Medium
Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status
- Mattermost
- Information disclosure
- CVSS 4.5 Medium
Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts
- Mattermost
- Information disclosure
- CVSS 6.5 Medium
Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads
- Mattermost
- Information disclosure
- CVSS 4.3 Medium
Private channel ID disclosure via user status endpoints
- Mattermost
- Information disclosure
- CVSS 4.9 Medium
Disclosure of AD/LDAP bind password via Test Connection
- Mattermost
- Information disclosure
- CVSS 6.5 Medium
Outgoing OAuth connection client secret exposure during connection validation
- Mattermost
- Information disclosure
- CVSS 2.7 Low
WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email
- smub WP Mail Logging
- Information disclosure
- CVSS 5.3 Medium
HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script
- realmag777 HUSKY – Products Filter for WooCommerce Professional
- Information disclosure
- CVSS 2.7 Low
Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions
- Product Delivery Date for WooCommerce
- Information disclosure
- CVSS 4.3 Medium
Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming
- Salon Booking System
- Information disclosure
- CVSS 4.3 Medium
Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget
- Visual Form Builder
- Information disclosure
- CVSS 5.3 Medium
Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons
- Document Gallery
- Information disclosure
- CVSS 5.3 Medium
Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure
- Coinsnap Bitcoin Crowdfunding
- Information disclosure
- CVSS 6.5 Medium
Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie
- Subscribe to Comments
- Information disclosure
- CVSS 4.3 Medium
Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML
- extendthemes Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy
- Information disclosure
- CVSS 7.8 High
Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary…
- Command injection
- Information disclosure