cve.bz

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, page 31

Filter

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

What the weakness is: CWE-200 at MITRE

Ask an AI about CWE-200

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/200.html and https://cve.bz/cve/cwe/200?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.2CVE-2026-35140EPSS 0.3%

    HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute on session cookies generated during authentication, which could allow a remote …

  2. 5.4CVE-2026-55608EPSS 0.3%

    n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLE_MULTI_TENANT=true could allow an authenticated tenant to access default-…

  3. 6.8CVE-2026-52888EPSS 0.5%

    NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL() function in packages/plugins/@nocobase/plu…

  4. 6.5CVE-2026-45737EPSS 0.5%

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configurati…

  5. 2.1CVE-2026-40956EPSS 0.3%

    CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a small amount of random memory to leak.

  6. 6.8CVE-2026-49988EPSS 0.2%

    Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without the f…

  7. 6.5CVE-2026-20298EPSS 0.3%

    In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the 'admin' o…

  8. 7.5CVE-2026-45793EPSS 1.0%

    Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an Unex…

  9. 6.6CVE-2026-58554EPSS 0.1%

    Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  10. 5.3CVE-2026-13230EPSS 0.4%

    An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on…

  11. 9.1CVE-2026-52101EPSS 0.5%

    An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upload.go

  12. 7.7CVE-2026-49853EPSS 0.4%

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth…

  13. 3.7CVE-2026-48001EPSS 0.5%

    Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require …

  14. 3.3CVE-2026-15642EPSS 0.2%

    Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault …

  15. 8.8CVE-2026-57102EPSS 0.8%

    Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  16. 7.8CVE-2026-57095EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an unauthorized attacker to elevate privileges locally.

  17. 5.5CVE-2026-56184EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally.

  18. 5.5CVE-2026-50681EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

  19. 5.5CVE-2026-50483EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information locally.

  20. 5.5CVE-2026-50473EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

  21. 5.5CVE-2026-50456EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

  22. 5.5CVE-2026-50442EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

  23. 5.5CVE-2026-50434EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.

  24. 5.5CVE-2026-50431EPSS 0.5%

    Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability

  25. 5.5CVE-2026-50430EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.

  26. 8.2CVE-2026-50429EPSS 1.1%

    Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network.

  27. 3.3CVE-2026-50419EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.

  28. 3.3CVE-2026-50416EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally.

  29. 7.5CVE-2026-50415EPSS 0.9%

    Exposure of sensitive information to an unauthorized actor in Windows Media allows an unauthorized attacker to disclose information over a network.

  30. 5.5CVE-2026-50409EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Overlay Filter allows an authorized attacker to disclose information locally.

  31. 5.5CVE-2026-50394EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally.

  32. 5.5CVE-2026-50389EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

  33. 5.5CVE-2026-50352EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

  34. 5.5CVE-2026-50339EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.

  35. 5.5CVE-2026-50334EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Notification allows an authorized attacker to disclose information locally.

  36. 7.8CVE-2026-50697EPSS 0.4%

    Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

  37. 5.5CVE-2026-50350EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Trusted Runtime Interface Driver allows an authorized attacker to disclose information locally.

  38. 6.2CVE-2026-49807EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally.

  39. 6.5CVE-2026-47282EPSS 0.9%

    Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  40. 5.5CVE-2026-41087EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

  41. 5.5CVE-2026-34349EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally.

  42. 5.5CVE-2026-34328EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Audio Service allows an authorized attacker to disclose information locally.

  43. 5.5CVE-2026-33842EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

  44. 7.1CVE-2026-55651EPSS 0.2%

    Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using…

  45. 6.9CVE-2026-52837EPSS 0.5%

    Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer r…

  46. 8.2CVE-2026-15075EPSS 0.2%

    In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no…

  47. 6.9CVE-2026-10051EPSS 0.4%

    In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first requ…

  48. 2.1CVE-2026-15627EPSS 0.4%

    A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/tool.go. Such manipulation of the argument args.targetUrl leads to information di…

  49. 4.3CVE-2026-12385EPSS 0.4%

    The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parameter. This makes it possible for authenticated attackers, with contributor-level …

  50. 5.5CVE-2026-15530EPSS 0.5%

    A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=upload of the component Attachment API. Executing a manipulation can lead to infor…