CWE-200

Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to perform spo

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior

Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0

OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allow

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or mo

Inappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to leak cros

The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in iOS 18.7

Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated

A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive use

Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an au

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when

A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive info

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to versio

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the notificationUsers publicatio

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization fl

In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.251

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-brac

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `/priv

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versi

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a user cou

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `GET /api/v1/projects/:proje

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an authoriza

A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is affecte

HCL Aftermarket DPC is affected by File Discovery which allows attacker could exploit this issue to read sensitive files

Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown

Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions

changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include

The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Informati

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to be

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to be

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Inappropriate implementation in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain poten

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbit

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revis

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernete

Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose in

The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. Thi

In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notif

OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is co

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes

Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunde

Vulnerability in the PeopleSoft Enterprise FIN Contracts product of Oracle PeopleSoft (component: Contracts). The supp

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Servic