CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-116 · CAPEC-13 · CAPEC-169 · CAPEC-22 · CAPEC-224 · CAPEC-285 · CAPEC-287 · CAPEC-290 · CAPEC-291 · CAPEC-292 · CAPEC-293 · CAPEC-294 · CAPEC-295 · CAPEC-296 · CAPEC-297 · CAPEC-298 · CAPEC-299 · CAPEC-300 · CAPEC-301 · CAPEC-302 · CAPEC-303 · CAPEC-304 · CAPEC-305 · CAPEC-306 · CAPEC-307 · CAPEC-308 · CAPEC-309 · CAPEC-310 · CAPEC-312 · CAPEC-313 · CAPEC-317 · CAPEC-318 · CAPEC-319 · CAPEC-320 · CAPEC-321 · CAPEC-322 · CAPEC-323 · CAPEC-324 · CAPEC-325 · CAPEC-326 · CAPEC-327 · CAPEC-328 · CAPEC-329 · CAPEC-330 · CAPEC-472 · CAPEC-497 · CAPEC-508 · CAPEC-573 · CAPEC-574 · CAPEC-575 · CAPEC-576 · CAPEC-577 · CAPEC-59 · CAPEC-60 · CAPEC-616 · CAPEC-643 · CAPEC-646 · CAPEC-651 · CAPEC-79
CVEs mapped to this weakness (11,660)
page 410 of 583| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-1748 | Low | 0.22 | 3.3 | 0.01 | Mar 24, 2016 | IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to obtain sensitive kernel memory-layout information via a crafted app. | ||
| CVE-2016-3155 | Low | 0.22 | 3.4 | 0.00 | Mar 18, 2016 | Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecified vectors. | ||
| CVE-2015-6644 | Low | 0.22 | 3.3 | 0.01 | Jan 6, 2016 | Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146. | ||
| CVE-2014-4407 | Low | 0.22 | 3.3 | 0.01 | Sep 18, 2014 | IOKit in Apple iOS before 8 and Apple TV before 7 does not properly initialize kernel memory, which allows attackers to obtain sensitive memory-content information via an application that makes crafted IOKit function calls. | ||
| CVE-2026-66853 | Med | 0.21 | 4.3 | 0.00 | Oct 14, 2026 | Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships… | ||
| CVE-2026-109526 | Low | 0.21 | 3.3 | 0.00 | Oct 13, 2026 | A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and… | ||
| CVE-2026-77362 | Med | 0.21 | 4.3 | 0.00 | Oct 13, 2026 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes,… | ||
| CVE-2026-109959 | Med | 0.21 | 4.3 | 0.00 | Oct 13, 2026 | EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/{id}, which… | ||
| CVE-2026-109958 | Med | 0.21 | 4.3 | 0.00 | Oct 13, 2026 | EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles… | ||
| CVE-2026-109948 | Med | 0.21 | 4.3 | 0.00 | Oct 13, 2026 | FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing… | ||
| CVE-2026-102663 | Med | 0.21 | 4.3 | 0.00 | Oct 12, 2026 | OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted… | ||
| CVE-2026-108861 | Med | 0.21 | 4.3 | 0.00 | Oct 11, 2026 | Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method naming denied fields… | ||
| CVE-2026-103964 | Med | 0.21 | 4.3 | 0.00 | Oct 10, 2026 | The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the… | ||
| CVE-2026-97626 | Med | 0.21 | 4.3 | 0.00 | Oct 6, 2026 | Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and `.atom` routes apply.… | ||
| CVE-2026-105748 | Med | 0.21 | 4.3 | 0.00 | Oct 5, 2026 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py validates serialized DoclingDocument… | ||
| CVE-2026-105684 | Med | 0.21 | 4.3 | 0.00 | Oct 5, 2026 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can… | ||
| CVE-2026-104963 | Med | 0.21 | 4.3 | 0.00 | Oct 5, 2026 | Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{slug}/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether… | ||
| CVE-2026-77321 | Med | 0.21 | 4.3 | 0.00 | Sep 24, 2026 | TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring trips:read and returns core trip summary data regardless of the delegated scopes. A token granted only… | ||
| CVE-2026-62286 | Med | 0.21 | 4.3 | 0.00 | Sep 24, 2026 | Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/stream. In a… | ||
| CVE-2026-16302 | Med | 0.21 | 4.3 | 0.00 | Sep 24, 2026 | The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editor_assets function, which exposes the uag_insta_linked_accounts option through the uagb_blocks_info object… |
- risk 0.22cvss 3.3epss 0.01
IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.
- risk 0.22cvss 3.4epss 0.00
Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecified vectors.
- risk 0.22cvss 3.3epss 0.01
Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146.
- risk 0.22cvss 3.3epss 0.01
IOKit in Apple iOS before 8 and Apple TV before 7 does not properly initialize kernel memory, which allows attackers to obtain sensitive memory-content information via an application that makes crafted IOKit function calls.
- risk 0.21cvss 4.3epss 0.00
Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships…
- risk 0.21cvss 3.3epss 0.00
A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and…
- risk 0.21cvss 4.3epss 0.00
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes,…
- risk 0.21cvss 4.3epss 0.00
EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/{id}, which…
- risk 0.21cvss 4.3epss 0.00
EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles…
- risk 0.21cvss 4.3epss 0.00
FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing…
- risk 0.21cvss 4.3epss 0.00
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted…
- risk 0.21cvss 4.3epss 0.00
Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method naming denied fields…
- risk 0.21cvss 4.3epss 0.00
The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the…
- risk 0.21cvss 4.3epss 0.00
Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and `.atom` routes apply.…
- risk 0.21cvss 4.3epss 0.00
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py validates serialized DoclingDocument…
- risk 0.21cvss 4.3epss 0.00
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can…
- risk 0.21cvss 4.3epss 0.00
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{slug}/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether…
- risk 0.21cvss 4.3epss 0.00
TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring trips:read and returns core trip summary data regardless of the delegated scopes. A token granted only…
- risk 0.21cvss 4.3epss 0.00
Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/stream. In a…
- risk 0.21cvss 4.3epss 0.00
The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editor_assets function, which exposes the uag_insta_linked_accounts option through the uagb_blocks_info object…