Skip to content
OpenAdvisories

Weakness (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Class Draft Mapping discouraged

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

    Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE-200

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-20133 Exploited EPSS 35%

    A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive inf…

    Cisco Cisco Catalyst SD-WAN Manager Network devices
    KEV Apr 20, 2026
  • Medium 5.3
    CVE-2025-68686 Exploited EPSS 29%

    An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS…

    Fortinet FortiOS Network devices
    KEV Jul 27, 2026
  • Medium 5.5
    CVE-2026-20805 Exploited Public exploit

    Desktop Window Manager Information Disclosure Vulnerability

    Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Jan 13, 2026
  • Medium 5.3
    CVE-2025-31125 Exploited Public exploit EPSS 75%

    Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

    Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This…

    vitejs vite vite npm
    KEV Jan 22, 2026
  • Medium 6.2
    CVE-2023-21237 Exploited

    In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification…

    Android
    KEV Mar 5, 2024
  • Medium 6.5
    CVE-2022-20821 Exploited EPSS 11%

    Cisco IOS XR Software Health Check Open Port Vulnerability

    A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379…

    Cisco Cisco IOS XR Software iOS Network devices
    KEV May 23, 2022
  • Medium 6.2
    CVE-2021-25369 Exploited

    An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel infor…

    Samsung Mobile Samsung Mobile Devices
    KEV Nov 8, 2022
  • Medium 5.3
    CVE-2016-2388 Exploited Public exploit EPSS 52%

    The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user info…

    KEV Jun 9, 2022