CWE-200

Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of

titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all glo

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /a

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/sett

The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leak

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iO

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14

Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose i

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.9, when

FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same devi

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid imag

IBM Guardium Data Protection 12.2.1, and 12.2.2 's add-on feature of Guardium Data Protection named "Long Term Retention

Inappropriate implementation in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obt

Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potent

A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/A

A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names l

A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` /

Nextcloud is an open source content collaboration platform. Prior to version 5.2.6, a missing permissions check allowed

D.Launcher 2 component of Slovak eID client ecosystem contains Improper URL Handler Processing vulnerability. Applicatio

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had com

Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-orig

Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-orig

Inappropriate implementation in GPU in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to leak cro

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had comp

Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convince

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, when cr

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache An

The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions 7.0 to 7.0.10.

Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose in

Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disc

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform sp

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows Fil

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to be

Allow authenticated users to access alert instances associated with alert groups they do not have permission to access.

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects G

Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-

Arbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to read ar

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repositor

OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint a

Inappropriate implementation in Input in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to obta

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-orig

Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who h

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-orig

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-orig

electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor