cve.bz

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, page 9

Filter

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

What the weakness is: CWE-200 at MITRE

Ask an AI about CWE-200

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/200.html and https://cve.bz/cve/cwe/200?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2026-90989EPSS 0.2%

    The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff.

  2. 5.3CVE-2026-107320EPSS 0.3%

    The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450.

  3. 5.3CVE-2026-106099EPSS 0.3%

    The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pa…

  4. 5.3CVE-2026-105969EPSS 0.3%

    The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to retrieve another guest's quote, including the buyer's name, email address a…

  5. 5.3CVE-2026-97471EPSS 0.3%

    The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter. This makes it possible for unauthenticated attackers to ext…

  6. 6.5CVE-2026-110146EPSS 0.2%

    Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)

  7. 7.5CVE-2026-85891EPSS 0.9%

    Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.

  8. 7.1CVE-2026-110217EPSS 0.6%

    Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator …

  9. 5.3CVE-2026-85733EPSS 0.2%

    FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this place…

  10. 7.5CVE-2026-103030EPSS 0.4%

    Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the …

  11. 1.9CVE-2026-109526EPSS 0.1%

    A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The expl…

  12. 6.5CVE-2026-102981EPSS 0.2%

    Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSer…

  13. 4.3CVE-2026-77362EPSS 0.2%

    obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes grou…

  14. 7.1CVE-2026-74047EPSS 0.3%

    Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attack…

  15. 5.3CVE-2026-109959EPSS 0.2%

    EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent …

  16. 5.3CVE-2026-109958EPSS 0.2%

    EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to…

  17. 5.3CVE-2026-109948EPSS 0.3%

    FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card han…

  18. 4.3CVE-2026-109777EPSS 0.2%

    Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  19. 4.3CVE-2026-109771EPSS 0.2%

    Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

  20. 4.3CVE-2026-109769EPSS 0.2%

    Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

  21. 4.3CVE-2026-109767EPSS 0.2%

    Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  22. 4.3CVE-2026-109751EPSS 0.3%

    Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  23. 4.3CVE-2026-109742EPSS 0.3%

    Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  24. 8.8CVE-2026-109709EPSS 0.3%

    Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  25. 4.3CVE-2026-89097EPSS 0.2%

    The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the ai_wp_footer_hook. This makes it possible for authenticated attackers, wit…

  26. 5.3CVE-2026-17487EPSS 0.2%

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.

  27. 5.5CVE-2026-17484EPSS 0.1%

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.

  28. 8.1CVE-2026-93892EPSS 0.3%

    IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.

  29. 6.5CVE-2026-82103EPSS 0.3%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.

  30. 4.3CVE-2026-75076EPSS 0.2%

    IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files.

  31. 5.5CVE-2026-108937EPSS 0.3%

    A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability affects unknown code of the file /database/medallion.sql. The manipulation results in file and directory information exposure. It is pos…

  32. 2.0CVE-2026-108930EPSS 0.3%

    A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_list_show.cgi of the component DDNS Handler. The manipulation of the argument user_idN/passwordN leads…

  33. 4.3CVE-2026-102663EPSS 0.3%

    OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally in…

  34. 6.5CVE-2026-77364EPSS 0.2%

    obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .…

  35. 7.7CVE-2026-85966EPSS 0.3%

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could …

  36. 7.1CVE-2026-109341EPSS 0.3%

    SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use P…

  37. 7.1CVE-2026-109335EPSS 0.3%

    SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUT…

  38. 8.7CVE-2026-109325EPSS 0.4%

    Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing sys…

  39. 7.1CVE-2026-109315EPSS 0.3%

    Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token thr…

  40. 8.5CVE-2026-109314EPSS 0.3%

    Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-c…

  41. 6.9CVE-2026-109304EPSS 0.3%

    Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via proj…

  42. 7.1CVE-2026-109293EPSS 0.4%

    Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /a…

  43. 7.6CVE-2026-109292EPSS 0.4%

    Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-co…

  44. 6.9CVE-2026-109259EPSS 0.3%

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitiali…

  45. 2.1CVE-2026-108811EPSS 0.2%

    A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out rem…

  46. 5.5CVE-2026-108810EPSS 0.3%

    A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument _func results in information disclosure. The attack c…

  47. 5.3CVE-2026-108861EPSS 0.3%

    Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read throu…

  48. 6.9CVE-2026-108578ExploitEPSS 1.5%

    A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely…

  49. 4.3CVE-2026-97183EPSS 0.2%

    The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of…

  50. 4.7CVE-2026-88785EPSS 0.09%

    The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential…