Information disclosure.

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Devolutions Server

• Devolutions Server
• Information disclosure

Cleartext storage of sensitive information in Devolutions Server

• Devolutions Server
• Information disclosure

Headless CMS Plugin REST API post get_required_post_data information disclosure

• Headless CMS Plugin
• Information disclosure
• Broken access control

Authenticated Sensitive Information Disclosure in VIA

• Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA)
• Information disclosure

Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

• MongoDB Rust Driver
• Information disclosure

Logging Redactor: PII data in str/repr of non primitive objects was not being redacted

• armurox loggingredactor
• Information disclosure

WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

• WPVibes AnyWhere Elementor
• Information disclosure

Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure

• Elastic Kibana
• Information disclosure

Arc has unauthenticated application log disclosure via `/api/v1/logs`

• Information disclosure
• Authentication bypass

<0.0.0-20260615165136-bb7d9761ad98 · fixed in 0.0.0-20260615165136-bb7d9761ad98

Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints

• coollabsio coolify
• Information disclosure

cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects

• silkimen cordova-plugin-advanced-http
• Information disclosure

CachingWebClient shares user-specific HTTP responses across users via the shared cache tier

• Eclipse Foundation Eclipse Vert.x
• Information disclosure
• CWE-524

Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook

• Finsys dockhand
• Information disclosure

Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

• froxlor
• Information disclosure

LDAP Bind Password Exposure in AxxonNet ARP Agent Logs

• AxxonSoft AxxonNet ARP Agent
• Information disclosure

User and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration API

• AxxonSoft Axxon One
• Information disclosure

weMail <= 2.1.6 - Editor+ API Key Disclosure

• weMail
• Information disclosure

WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token

• WATI Chat and Notification
• Information disclosure

Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses

• Red Hat build of Apache Camel 4 for Quarkus 3
• Red Hat build of Apicurio Registry 3
• Information disclosure

Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages

• octo-sts app
• Information disclosure

EchoHS GeekezBrowser Public API status information disclosure

• EchoHS GeekezBrowser
• Information disclosure
• Broken access control

Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy

• SUSE Rancher
• Information disclosure

An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable src

• redimp otterwiki
• Information disclosure

Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1

• regularlabs.com Users Anywhere (Free, Pro) extension for Joomla
• Information disclosure

Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data

• WSO2 API Manager
• WSO2 Traffic Manager
• Information disclosure

Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths

• WSO2 Identity Server
• WSO2 Open Banking IAM
• Information disclosure

Information disclosure in Huawei HarmonyOS and others

• Huawei HarmonyOS
• Huawei EMUI
• Information disclosure

Information disclosure in Huawei HarmonyOS

• Huawei HarmonyOS
• Information disclosure

Sensitive information in log files in MediaTek, Inc. MediaTek chipset

• MediaTek, Inc. MediaTek chipset
• Information disclosure

Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response

• parse-community parse-server
• Information disclosure

samanhappy MCPHub passthroughHeaders.ts information disclosure

• samanhappy MCPHub
• Information disclosure
• Broken access control

Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader

• Apache Software Foundation Apache Wicket
• Information disclosure

ag-ui-protocol ag-ui HttpAgent http.ts information disclosure

• ag-ui
• Information disclosure
• Broken access control

Beta9 host filesystem exposure via volume path traversal

• beam-cloud Beta9 gateway
• beam-cloud Beta9 worker
• Path traversal
• Information disclosure

Gitea OAuth2 userinfo private group disclosure to public-only tokens

• Gitea
• Information disclosure
• Broken access control

Gitea private issue disclosure through issue dependency timeline events

• Gitea
• Information disclosure
• Broken access control

Gitea contribution heatmap private activity disclosure to public-only tokens

• Gitea
• Information disclosure

Gitea Actions task token private repository enumeration

• Gitea
• Information disclosure
• Broken access control

MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure

• MapPress
• Information disclosure

Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure

• Kali Forms — Contact Form & Drag-and-Drop Builder
• Information disclosure

Presenton Desktop Authentication Middleware app_data information disclosure

• Presenton
• Information disclosure
• Broken access control

Konflux-ci: github token plaintext exposure in ci/cd scripts

• Information disclosure

All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter

• smub All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
• Information disclosure

Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter

• melograno Booking for Appointments and Events Calendar – Amelia
• Information disclosure

Seraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory

• seraphinitesoft Seraphinite Accelerator
• Information disclosure

Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download

• Quick Event Manager
• Information disclosure

All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure

• All-in-One Video Gallery
• Information disclosure

Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Settings Page

• Payment Forms for Paystack
• Information disclosure

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs

• Information disclosure
• Broken access control

<0.0.0-20260904182349-be4723e33727 · fixed in 0.0.0-20260904182349-be4723e33727

Nuxt dev server exposes generated appSecret through Vite file serving

• Information disclosure

>=4.6.0, <4.6.3 · fixed in 4.6.3

Nuxt dev server exposes private runtime config through the Nitro dev bundle

• Information disclosure

>=3.0.0, <4.6.3 · fixed in 4.6.3

follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

• Information disclosure

>=1.16.0, <1.16.2 · fixed in 1.16.2

Element Call exposes shared passwords in logs

• element-hq element-call
• Information disclosure

jack: upstream error responses expose backend and peer credentials

• roziscoding jack
• Information disclosure