Weakness (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it (1 mitigation)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-200
25 results · Clear filters · Feed
-
Critical 9.8CVE-2026-26897 Public exploit
An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain…
-
Critical 10.0
PraisonAI before 1.6.78 Remote Code Execution via CodeAgent
PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through promp…
-
Critical 9.3CVE-2026-55450 Public exploit
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This ca…
-
Critical 9.3CVE-2026-46395 Public exploit
HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker …
-
Critical 9.2CVE-2026-27886 Public exploit
Strapi may leak sensitive data via relational filtering due to lack of query sanitization
Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` q…
-
Critical 9.1CVE-2026-45091 Public exploit
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unse…
-
Critical 9.6CVE-2026-42880 Public exploit
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with r…
-
Critical 10.0CVE-2026-42826 Public exploit
Azure DevOps Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network.
-
Critical 9.0CVE-2025-63729 Public exploit
An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL P…
-
Critical 9.8
AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for u…
-
Critical 9.4CVE-2025-61777 Public exploit
FlagForge Allows Unauthenticated Badge Template API Access
Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without authentication or authoriz…
-
Critical 9.8CVE-2025-9209 Public exploit
RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT
The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This ma…
-
Critical 9.8CVE-2025-50738 Public exploit
Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs
The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction be…
-
Critical 9.4CVE-2025-29628 Public exploit
A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware bef…
-
Critical 9.1CVE-2025-52467 Public exploit
pgai secrets exfiltration via `pull_request_target`
pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to commit 8eb3567, the pgai repository was vulnerable to an attack allowing the exfiltration of all secrets used in one workflow. In particular…
-
Critical 9.8CVE-2025-32958 Public exploit
Adept exposed the GITHUB_TOKEN in workflow run artifact
Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the mac-standalone artifact. This artifact is a zip of the current directory, which includes the automati…
-
Critical 9.8CVE-2025-24204 Public exploit
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access p…
-
Critical 9.8CVE-2024-55875 Public exploit
http4k has a potential XXE (XML External Entity Injection) vulnerability
http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read loc…
-
Critical 9.1CVE-2024-42049 Public exploit
TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection.
-
Critical 9.6CVE-2023-6572 Public exploit
Command Injection in gradio-app/gradio
Command Injection in GitHub repository gradio-app/gradio prior to main.
-
Critical 10.0
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relie…
KEV Nov 30, 2023 -
Critical 9.9CVE-2023-40029 Public exploit
Cluster secret might leak in cluster details page in Argo CD
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. p…
-
Critical 10.0
GeoJSON URL validation can expose server files and environment variables to unauthorized users
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment varia…
KEV Nov 12, 2024 -
Critical —
Bypass of the fix for CVE-2019-0195
A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Befor…
-
Critical 9.8
Anchor CMS Logs Credentials
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.