cve.bz

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, page 24

Filter

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

What the weakness is: CWE-200 at MITRE

Ask an AI about CWE-200

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/200.html and https://cve.bz/cve/cwe/200?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.1CVE-2026-55982EPSS 0.5%

    OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

  2. 4.3CVE-2026-50105EPSS 0.4%

    RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

  3. 8.7CVE-2026-73622EPSS 0.5%

    GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URL…

  4. 7.1CVE-2026-73604EPSS 0.4%

    Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensi…

  5. 9.1CVE-2026-59503EPSS 0.4%

    : Exposure of Sensitive Information to an Unauthorized Actor : Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue af…

  6. 8.6CVE-2026-59499EPSS 0.4%

    : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions).. This issue affects Portal Generator addon to Priority ERP (developed by Soft Sol…

  7. 6.3CVE-2026-73411EPSS 0.6%

    Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : or = when applications use the escape or escapeAll APIs on Unix with shell set to…

  8. 7.5CVE-2026-73406EPSS 0.5%

    Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthentic…

  9. 5.7CVE-2026-73308EPSS 0.4%

    Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress …

  10. 9.2CVE-2026-72804EPSS 0.4%

    SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints wi…

  11. 5.3CVE-2026-18673EPSS 0.5%

    When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach t…

  12. 6.5CVE-2026-65017EPSS 0.4%

    Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration…

  13. 4.3CVE-2026-54183EPSS 0.4%

    Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Ai…

  14. 4.4CVE-2026-47234EPSS 0.2%

    Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment thi…

  15. 5.3CVE-2026-19073EPSS 0.3%

    The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticat…

  16. 6.5CVE-2026-18943EPSS 0.4%

    The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to …

  17. 7.5CVE-2026-18049EPSS 0.4%

    The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own option…

  18. 7.5CVE-2026-16253EPSS 0.4%

    The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to …

  19. 7.5CVE-2026-14925EPSS 0.4%

    The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain…

  20. 6.5CVE-2026-13168EPSS 0.4%

    The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.

  21. 6.5CVE-2026-12976EPSS 0.4%

    The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain …

  22. 7.5CVE-2026-73246EPSS 0.6%

    Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task …

  23. 5.9CVE-2026-73230EPSS 0.2%

    Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card …

  24. 4.3CVE-2026-73229EPSS 0.4%

    Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.ge…

  25. 8.2CVE-2026-48771EPSS 0.4%

    ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using…

  26. 7.6CVE-2026-48767EPSS 0.4%

    TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper `getAccessToken`. The vu…

  27. 5.3CVE-2026-73082EPSS 0.4%

    Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without UR…

  28. 6.5CVE-2026-66301EPSS 1.0%

    Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.

  29. 7.5CVE-2026-65769EPSS 0.9%

    Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network.

  30. 7.5CVE-2026-61924EPSS 0.9%

    Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

  31. 6.5CVE-2026-61921EPSS 0.9%

    Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

  32. 7.5CVE-2026-61918EPSS 0.9%

    Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

  33. 5.6CVE-2026-59130EPSS 0.4%

    No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally.

  34. 5.5CVE-2026-54123EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.

  35. 6.3CVE-2026-20737EPSS 0.2%

    Exposure of sensitive information to an unauthorized actor for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthentica…

  36. 7.6CVE-2026-48766EPSS 0.4%

    TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled `baseUrl`…

  37. 6.9CVE-2026-72744EPSS 0.2%

    Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.devtools.json). The en…

  38. 5.3CVE-2026-72549EPSS 0.5%

    An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function…

  39. 7.5CVE-2026-72548EPSS 0.6%

    An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId par…

  40. 6.5CVE-2026-72539EPSS 0.4%

    An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email …

  41. 3.6CVE-2026-11985EPSS 0.1%

    On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the "Floating point ABI" choice, which defaults to CONFIG_FP_HARDABI. Both FP_HARDABI and FP_SOFTABI permit the compiler to emit hardware FP instructions in any function…

  42. 7.5CVE-2026-72915EPSS 0.5%

    Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access per…

  43. 6.5CVE-2026-72873EPSS 0.5%

    Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/app…

  44. 6.5CVE-2026-72726EPSS 0.5%

    Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 20…

  45. 5.3CVE-2026-72760EPSS 0.4%

    Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, get_following() includes the followed user's email field in the API re…

  46. 7.5CVE-2026-61899EPSS 0.7%

    Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.

  47. 5.3CVE-2026-19074EPSS 0.2%

    The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action `acadp_public_custom_fields_listings…

  48. 7.5CVE-2026-18946EPSS 0.4%

    The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download f…

  49. 7.5CVE-2026-18470EPSS 0.4%

    The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to …

  50. 7.5CVE-2026-17542EPSS 0.4%

    The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directo…