Advisories · Weakness
Information disclosure.
Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python
- Google Agent Development Kit (ADK) for Python
- Information disclosure
- CVSS 5.3 Medium
a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure
- a2ui
- Information disclosure
- CVSS 8.8 High
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 9.6 CriticalCritical · CVSS 9+
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 6.5 Medium
MLflow CrewAI autologging records LLM provider API keys in logged trace spans
- Information disclosure
>=2.19.0, <3.17.0 · fixed in 3.17.0
GHSA-j7qq-vr8c-xvw3 · CVE-2026-116691 - CVSS 5.9 Medium
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
- Information disclosure
>=1.8.0, <1.30.0 || >=2.0.0, <2.2.0 · fixed in 1.30.0, 2.2.0
GHSA-5h93-6whr-6q8j · CVE-2026-116685 - CVSS 8.1 High
Bypass of remote UNC path restriction in mailbox: URLs
- Mozilla Thunderbird
- Information disclosure
- CVSS 7.5 High
Content of other messages could be included when replying to a crafted message
- Mozilla Thunderbird
- Information disclosure
- CVSS 4.3 Medium
Tanium addressed an information disclosure vulnerability in Tanium Server.
- Tanium Server
- Information disclosure
- CVSS 6.6 Medium
Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.
- Tanium Reputation
- Information disclosure
- CVSS 4.2 Medium
Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response.
- Tanium Threat Response
- Information disclosure
- CVSS 3.3 Low
Information disclosure in Nextcloud Tables
- Nextcloud Tables
- Information disclosure
- CVSS 2.3 Low
rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert
- Information disclosure
>=0.23.44, <0.23.46 || >=0.24.0-dev.1, <0.24.0-dev.2 · fixed in 0.23.46, 0.24.0-dev.2
GHSA-vp88-798v-h67f - CVSS 2.3 Low
Host filesystem path disclosure via DNS rebinding
- Information disclosure
>=0.8.0, <0.9.2 · fixed in 0.9.2
EEF-CVE-2026-109823 · CVE-2026-109823 - CVSS 8.7 High
GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)
- Path traversal
- Command injection
<3.2.0 · fixed in 3.2.0
GHSA-23mf-xhv8-69c2 · CVE-2026-110859 - CVSS 7.1 High
GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name
- Information disclosure
<3.2.0 · fixed in 3.2.0
GHSA-fx3j-rwgx-fr94 · CVE-2026-110855 - CVSS 8.7 High
Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback
- grav
- Information disclosure
- CVSS 8.1 High
Information disclosure in the Networking: DNS component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- CVSS 8.1 High
Information disclosure due to race condition in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- CVSS 8.1 High
Information disclosure in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- CVSS 6.5 Medium
Information disclosure in the CSS Parsing and Computation component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- CVSS 5.7 Medium
Docker Desktop logs can expose stored third-party credentials
- Docker Desktop
- Information disclosure
- CVSS 7.7 High
Sensitive information in log files in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Information disclosure
- CVSS 4.9 Medium
Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability
- SMCI MBD-X12SPI
- Information disclosure
- CVSS 6.2 Medium
An issue in Shirt Pocket's SuperDuper!
- Information disclosure
- CVSS 8.4 High
OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query
- openpanel
- Information disclosure
- CVSS 7.1 High
OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs
- openpanel
- Information disclosure
- CVSS 5.3 Medium
OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list
- openpanel
- Information disclosure
- CVSS 6.9 Medium
TOTOLINK A950RG global.so getLanguageCfg information disclosure
- TOTOLINK A950RG
- Information disclosure
- Broken access control
- CVSS 6.5 Medium
Information disclosure in Apple macOS
- Apple macOS
- Information disclosure
- CVSS 5.5 Medium
Information disclosure in Apple iOS and iPadOS
- Apple iOS and iPadOS
- Information disclosure
- CVSS 3.3 Low
Sensitive information in log files in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Information disclosure
- CVSS 3.3 Low
Information disclosure in Apple macOS
- Apple macOS
- Information disclosure
- CVSS 5.5 Medium
Information disclosure in Apple macOS
- Apple macOS
- Information disclosure
- CVSS 3.3 Low
Information disclosure in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Information disclosure
- CVSS 3.3 Low
Sensitive information in log files in Apple macOS
- Apple macOS
- Information disclosure
- CVSS 3.3 Low
Information disclosure in Apple macOS
- Apple macOS
- Information disclosure
- CVSS 5.5 Medium
Information disclosure in Apple macOS
- Apple macOS
- Information disclosure
- CVSS 6.2 Medium
Information disclosure in Apple macOS
- Apple macOS
- Information disclosure
- CVSS 3.3 Low
Information disclosure in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Information disclosure
- CVSS 4.0 Medium
Information disclosure in Apple macOS
- Apple macOS
- Information disclosure
- CVSS 5.5 Medium
Information disclosure in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Information disclosure
- CVSS 5.3 Medium
Information disclosure in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Information disclosure
- CVSS 6.2 Medium
Sensitive information in log files in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Information disclosure
- CVSS 5.5 Medium
Information disclosure in Apple macOS
- Apple macOS
- Information disclosure
- CVSS 6.2 Medium
Information disclosure in Apple macOS
- Apple macOS
- Information disclosure
- CVSS 3.3 Low
Information disclosure in Apple iOS and iPadOS
- Apple iOS and iPadOS
- Information disclosure
- CVSS 5.9 Medium
Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose
- Information disclosure
>=1.3.0, <1.11.13 · fixed in 1.11.13
GHSA-vwvr-f994-6j9j · CVE-2026-65626 - CVSS 5.3 Medium
a2aproject a2a-java JSON-RPC Error getMessage information exposure
- a2aproject a2a-java
- Information disclosure
- CVSS 6.9 Medium
a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure
- a2aproject a2a-go
- Information disclosure
- CVSS 5.3 Medium
a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure
- a2aproject a2a-dotnet
- Information disclosure
- CVSS 6.9 Medium
OctoPrint API Key settings.py getSettings information disclosure
- OctoPrint
- Information disclosure
- Broken access control
- CVSS 6.9 Medium
Cleartext Storage of Sensitive Information in boneIO
- boneIO
- Information disclosure
- CVSS 5.3 Medium
Kameleo Local API user-info information disclosure
- Kameleo
- Information disclosure
- Broken access control
- CVSS 5.3 Medium
Kameleo Local API profiles information disclosure
- Kameleo
- Information disclosure
- Broken access control
- CVSS 5.3 Medium
Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure
- Kameleo
- Information disclosure
- Broken access control
- CVSS 4.8 Medium
Kameleo Profile Controller t.cs ListProfiles information disclosure
- Kameleo
- Information disclosure
- Broken access control
- CVSS 6.5 Medium
WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability
- David Lingren Media LIbrary Assistant
- Information disclosure
- CVSS 4.4 Medium
Cleartext Storage of Windows Service Account Password in BRAIN2 Setup Log Files
- Bizerba SE & Co. KG BRAIN2
- Information disclosure
- CVSS 6.5 Medium
Out-of-Bounds Read via Unchecked Length Values
- RT-Labs AB SOEM
- Memory corruption
- Information disclosure