CWE-200

This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.

A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sequoia 15.

A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.

The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 18.4 and iPadOS 1

Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses act

Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate

An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive informa

In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to

The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a us

A permissions issue was addressed with additional restrictions. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6

This issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7.

An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. Once access is gained either by default, common, or c

An issue was discovered on KuWFi GC111 GC111-GL-LM321_V3.0_20191211 devices. The TELNET service is enabled by default an

In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in e

OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients. This can lead

The issue was addressed with improved checks. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26. An

The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service

The Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information via an unauthenticated Te

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain acc

The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.

A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks

The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,

Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified

MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is acc

An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. When they are powered on, an X11 dis

An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mob

The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all vers

Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosur

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Host

Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logi

A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware befo

Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/b

GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulne

PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's

pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to c

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.1

Supported versions of Mahara 24.04 before 24.04.1 and 23.04 before 23.04.6 are vulnerable to information being disclosed

Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to be

When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a passwo

An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INF

An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Pr

Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request cou

Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wf_get_cookie shortcode. This makes

An issue in user interface in Kyocera Command Center RX EXOSYS M5521cdn allows remote to obtain sensitive information vi

z80pack is a mature emulator of multiple platforms with 8080 and Z80 CPU. In version 1.38 and prior, the `makefile-ubunt

Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based tim

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information di

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that aut