Advisories · Weakness
Information disclosure.
Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.7 Medium
A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure
- Information disclosure
<1.3.0.Final · fixed in 1.3.0.Final
GHSA-x32g-jvvm-4725 · CVE-2026-111762 - CVSS 8.8 High
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Information disclosure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Information disclosure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Information disclosure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Information disclosure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 9.6 CriticalCritical · CVSS 9+
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 6.5 Medium
Information disclosure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 9.6 CriticalCritical · CVSS 9+
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Information disclosure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Information disclosure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Information disclosure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 6.5 Medium
Information disclosure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Information disclosure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Information disclosure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 9.6 CriticalCritical · CVSS 9+
Resource exposure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 9.6 CriticalCritical · CVSS 9+
Resource exposure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 9.6 CriticalCritical · CVSS 9+
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Information disclosure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 5.4 Medium
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Information disclosure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 8.8 High
Information disclosure in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 5.9 Medium
@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
- Information disclosure
<=19.2.25 || >=20.0.0, <20.3.34 || >=21.0.0, <21.0.3 · fixed in 20.3.34, 21.0.3
GHSA-jfgx-762w-99vr · CVE-2026-111753 - CVSS 9.1 CriticalCritical · CVSS 9+
Authorization: Negotiate sent to foreign origin
- curl
- Information disclosure
- CVSS 8.1 High
TFTP direction confusion
- curl
- Information disclosure
- CVSS 8.1 High
HSTS response erases persisted entries
- curl
- Information disclosure
- CVSS 8.1 High
HSTS cache import drops longer-lived child
- curl
- Information disclosure
- CVSS 9.1 CriticalCritical · CVSS 9+
cross-origin reuse of a Negotiate connection
- curl
- Information disclosure
- CVSS 7.5 High
auto client cert connection reuse mixup
- curl
- Information disclosure
- CVSS 9.1 CriticalCritical · CVSS 9+
leaking host credentials to HTTP proxy
- curl
- Information disclosure
- CVSS 9.1 CriticalCritical · CVSS 9+
Negotiate credentials sent to redirected origin
- curl
- Information disclosure
- CVSS 8.1 High
stale SigV4 headers sent unintended
- curl
- Information disclosure
- CVSS 6.5 Medium
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
- Information disclosure
>=2.0.0, <2.3.0 · fixed in 2.3.0
GHSA-6prh-2h8m-c8cw · CVE-2026-111769 - CVSS 5.6 Medium
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
- Information disclosure
- Hard-coded credentials
>=1.25.0, <1.28.0 · fixed in 1.28.0
GHSA-hhph-8536-gfq5 · CVE-2026-113652 - CVSS 5.3 Medium
ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
- Information disclosure
- Broken access control
<4.33.0 · fixed in 4.33.0
GHSA-gqh3-7856-rjjg · CVE-2026-113668 - CVSS 8.2 High
follow-redirects array-form headers bypass cross-origin credential stripping
- Information disclosure
- CWE-212
>=1.16.0, <1.16.1 · fixed in 1.16.1
GHSA-q3jh-wrc6-jgq8 · CVE-2026-111756 - CVSS 8.2 High
follow-redirects sensitiveHeaders regex escaping can expose credential headers
- Information disclosure
- CWE-185
>=1.16.0, <1.16.1 · fixed in 1.16.1
GHSA-8r9p-f939-6h3c · CVE-2026-111755 - CVSS 4.4 Medium
SolarWinds Patch Manager Sensitive Information Exposure Vulnerability
- SolarWinds Patch Manager
- Information disclosure
- CVSS 6.0 Medium
Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs
- Apache Software Foundation Apache CouchDB
- Information disclosure
- CVSS 7.5 High
Apache Cocoon: Unauthenticated access to diagnostic interfaces
- Apache Software Foundation Apache Cocoon
- Information disclosure
- CVSS 7.1 High
TYPO3-EXT-SA-2026-035: Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)
- Information disclosure
<14.0.2 · fixed in 14.0.2
PKSA-kk39-vqqg-74n6 · CVE-2026-113459 - CVSS 4.3 Medium
Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
- Easy Property Listings
- Information disclosure
- CVSS 5.3 Medium
Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
- Easy Property Listings
- Information disclosure
- CVSS 5.5 Medium
Information disclosure in Apple macOS
- Apple macOS
- Information disclosure
- CVSS 5.5 Medium
Information disclosure in Apple macOS
- Apple macOS
- Information disclosure
- CVSS 5.5 Medium
Information disclosure in Apple macOS
- Apple macOS
- Information disclosure
- CVSS 5.5 Medium
Information disclosure in Apple macOS
- Apple macOS
- Information disclosure
- Broken access control
- CVSS 5.3 Medium
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header
- Information disclosure
- CVSS 8.7 High
Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives
- grav
- Information disclosure
- CVSS 7.1 High
Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters
- cms
- Information disclosure
- CVSS 5.3 Medium
IBM Concert Software Information Disclosure
- IBM Concert
- Information disclosure
- CVSS 5.3 Medium
Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery
- WSO2 Identity Server
- WSO2 Carbon Abstract OTP Authenticator
- Information disclosure
- CVSS 8.2 High
Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover
- WSO2 Identity Server as Key Manager
- WSO2 Open Banking IAM
- Information disclosure
- CWE-281
- CVSS 4.9 Medium
Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials
- WSO2 Universal Gateway
- WSO2 Traffic Manager
- Information disclosure
- CVSS 8.5 High
Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables
- Eptura Archibus
- Information disclosure