CWE-209
CVEs classified under CWE-209, newest first.
121 CVEsRSS
CVE-2026-108316Medium· 4.3Tanium addressed an information disclosure vulnerability in Tanium Server.
Tanium addressed an information disclosure vulnerability in Tanium Server.
CVE-2026-116478Medium· 5.3a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through …
CVE-2026-116479Medium· 4.3a2aproject a2a-java JSON-RPC Error getMessage information exposure
A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiate…
CVE-2026-116477Medium· 4.3a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure
A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component…
CVE-2026-101259Medium· 5.3Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build…
CVE-2026-115496Medium· 6.9Workflow names may be leaked to unauthenticated users in KNIME Business Hub
Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible.
CVE-2026-114348Medium· 5.3webpack-dev-server: webpack-dev-server: Information disclosure via malformed Host header (CVE-2026-114348)
A flaw was found in webpack-dev-server. An unauthenticated remote attacker can exploit improper Host header validation in the open-editor endpoint to obtain sensitive technical information. By sending a request with a specially crafted Hos…
CVE-2026-112947Medium· 6.3Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
CVE-2026-113705Medium· 5.3a2aproject a2a-rs error.rs information exposure
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack …
CVE-2026-3628Medium· 5.3IBM Concert Software Information Disclosure
IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.
CVE-2026-84180Medium· 5.3PoCorg.apache.camel/camel-knative: Apache Camel Knative: Information disclosure via error responses (CVE-2026-84180)
A flaw was found in Apache Camel's Knative component. When message processing fails on the consumer side, the application writes unhandled exception details—including class names, error messages, and stack traces—directly into the HTTP res…
CVE-2026-85246Medium· 5.3PoCApache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed, the…
CVE-2026-85257Medium· 5.3PoCApache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer fai…
CVE-2026-85315Medium· 5.3PoCApache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed…
CVE-2026-110889High· 7.5WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability
Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.
CVE-2026-91882High· 8.6Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API client error handling component
Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API client error handling component. An unauthenticated attac…
CVE-2026-86607Medium· 4.3Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator. This issue affects Hitachi Ops Center Administrator: before 11.0.9-01.
Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator. This issue affects Hitachi Ops Center Administrator: before 11.0.9-01.
CVE-2026-14909Medium· 6.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.
CVE-2026-83786Medium· 4.7Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally.
Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally.
CVE-2026-52394Critical· 9.1PoCDeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.
DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.
CVE-2026-85115Medium· 5.5A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62)
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow …
CVE-2026-105283Medium· 6.3PoCGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder …
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder …
CVE-2026-75597Medium· 5.3PoCpyLoad is a free and open-source download manager written in Python
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requ…
CVE-2026-78021Low· 3.7Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially explo…
CVE-2026-105828Medium· 6.3Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled
Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticate…
CVE-2026-106502Medium· 5.3Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure con…
CVE-2026-101029Medium· 4.3Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to
Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileg…
CVE-2026-106123Medium· 5.5The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI …
CVE-2026-105707Medium· 5.3PoCA security vulnerability has been detected in uptrace up to 2.1.0-beta.8
A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user_handler.go. The manipulation leads to information exposure through error message. It …
CVE-2026-67172Low· 3.7HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints
HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an…