CWE-1295 · weakness in Information Disclosure
Debug Messages Revealing Unnecessary Information
22 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 22 is a mark on the map. Named now: 1 to 22, most at risk first.
- Apache Airflow: Sensitive configuration values are not masked in the logs by default
- Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
- Apache JSPWiki: Error Handling - Reveals Error Details
- QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)
- Advantech WebAccess Debug Messages Revealing Unnecessary Information
- WordPress GTM Kit plugin <= 2.4.0 - Sensitive Data Exposure vulnerability
- Aimeos HTML client may potentially reveal sensitive information in error log
- Detailed Error Response Vulnerability in Meon KYC solutions
- C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function. Honeywell recommends updating to the most rece…
- UART Leaking Sensitive Data in dormakaba registration unit 9002
- Event-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in eda
- Debug Messages Revealing Unnecessary Information in GitLab
- Oauth-server-container: oauth-server-container logs client secret in debug level
- Session disclosure inside the log files
- Dell BSAFE SSL-J, versions before 6.5 and version 7.0 contain a debug message revealing unnecessary information vulnerability. This may lead to disclosing sensitive information to…
- Dell BSAFE SSL-J, versions prior to 6.5, and versions 7.0 and 7.1 contain a debug message revealing unnecessary information vulnerability. This may lead to disclosing sensitive in…
- SolarEdge SE3680H - Information Exposure during Bootloader Loop
- A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions,…
- Inappropriate implementation in Passkeys in Google Chrome prior to 140.0.7339.80 allowed a local attacker to obtain potentially sensitive information via debug logs. (Chromium sec…
- Medical Informatics Engineering Enterprise Health includes session token in debug output
- An information disclosure vulnerability in Widevine TA log prior to SMR Oct-2021 Release 1 allows attackers to bypass the ASLR protection mechanism in TEE.
- In DA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure, if an attacker has physical access to the device, if…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.