CWE-200
CVEs classified under CWE-200, newest first.
1385 CVEsRSS
CVE-2026-109934Medium· 5.3Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unaut…
CVE-2026-109935Medium· 5.3Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner r…
CVE-2026-57146High· 7.5PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes th…
CVE-2026-56834High· 7.5PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools(). The implemented artifact tools do not enforce that…
CVE-2026-57116Critical· 9.8PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm9…
CVE-2026-56833High· 7.5PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. …
CVE-2026-115449Low· 3.5Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest
A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch …
CVE-2026-115516Medium· 6.9Basic account information visible to unauthenticated user in Business Hub SaaS
An incorrect authorization issue exposes basic account information to unauthorized remote users in KNIME Business Hub SaaS before version 1.19.0. A workaround is not possible. The same behaviour is present in on-premise KNIME Business H…
CVE-2026-114606Medium· 5.6draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)
draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpF…
CVE-2026-114657Medium· 5.7Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri
Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH…
CVE-2026-114574Medium· 4.3massCodeIO massCode Local HTTP Service index.ts information disclosure
A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possi…
CVE-2026-76306High· 7.5Information Disclosure through REST API Query Filters in Splunk SOAR
In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users. The information disclos…
CVE-2026-76307High· 7.2Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR
In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the inferred token g…
CVE-2026-105999Medium· 5.3Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administr…
CVE-2026-108073Medium· 5.3SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthen…
CVE-2026-111956Medium· 5.9WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user…
CVE-2026-92999Medium· 5.3Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record (names, email addresses …
CVE-2026-112947Medium· 6.3Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
CVE-2026-112948Medium· 6.5Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
CVE-2026-112953Medium· 6.0PoCApostropheCMS: Exposure of Sensitive Information via predictable export filenames
ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
CVE-2026-112952Medium· 4.3ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
CVE-2026-113705Medium· 5.3a2aproject a2a-rs error.rs information exposure
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack …
CVE-2026-113706Low· 3.5a2aproject a2a-rs inmemory.rs information disclosure
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attac…
CVE-2026-92389NoneTFTP direction confusion
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download re…
CVE-2026-94265NoneAuthorization: Negotiate sent to foreign origin
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can …
CVE-2026-113157Medium· 6.5Information leak in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page
Information leak in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-111769Medium· 6.5MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
CVE-2026-113668Medium· 5.3ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's oth…
CVE-2026-111756High· 7.5PoCfollow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects (CVE-2026-111756)
A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, …
CVE-2026-113652Medium· 5.6ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sa…