Weakness (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it (1 mitigation)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-200
6,460 results · Feed
-
Medium 4.0
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The support…
-
Medium 4.0
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The support…
-
Medium 5.3
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The support…
-
High 7.7
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported vers…
-
Low 3.7
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 8.1
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
High 7.8
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The…
-
High 7.8
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The…
-
High 7.5
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Managem…
-
Medium 4.3
Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web o…
-
Critical 9.0
Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints
Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins…
-
Medium 4.3
MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.…
-
High 7.5
CodeWhale before 0.8.64 Environment Variable Leak via js_execution
CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the to…
-
High 7.4
CodeWhale before 0.8.64 Argument Injection via git_blame
CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path…
-
High 7.5
CodeWhale before 0.8.64 Arbitrary File Read via instructions
CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside …
-
Low 2.7
File Browser: Share API exposes the password hash and bypass token
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandl…
-
High 7.6
Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member…
-
Critical 9.1
Site isolation issue in the CSS Parsing and Computation component
Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
-
Medium 4.3
Information disclosure in the DOM: UI Events & Focus Handling component
Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
-
Medium 4.3
Information disclosure in the DOM: Push Subscriptions component
Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
-
Medium 6.5
Information disclosure in the Graphics component
Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
-
Medium 6.5CVE-2026-74945 Public exploit
Information disclosure in the Graphics: Text component
Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
-
High 7.5
Site isolation issue in the Graphics: CanvasWebGL component
Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
-
Medium 4.3
ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints
ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler), which authenticate but do not authorize access. O…
-
High 7.5
An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via …
-
Low 3.6
Plaintext pre-auth secret exposure via Desktop App diagnostics report
Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for…
-
Medium 5.5
An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10,…
-
Medium 6.5
The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS…
-
Critical 9.6
Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers
Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStora…
-
High 8.5
Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects…
-
Medium 5.3
Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config…
-
Critical 9.1
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model object…
-
Medium 6.2
Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affec…
-
Medium 6.2
Permission control vulnerability in the notification service module. Impact: Successful exploitation of this vulnerabil…
-
Medium 6.2
Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability …
-
Low 3.1
Orange View Limited DualSafe Password Manager & Digital Vault Extension postMessage-based Bridge information disclosure
A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. Th…
-
Critical 9.8
Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a cer…
-
High 7.5
OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation
OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through …
-
High 7.5
CatFolders Document Gallery < 2.0.7 - Unauthenticated Attachment Disclosure via REST API
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any…