Skip to content
BackEsc
Sign in

CWE-203 · weakness in Information Disclosure

Observable Discrepancy

689 CVEs · 1 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
1
check available
11
likely to be exploited
17

Every one of the 689 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploite…CVE-2024-39891Twilio · CVSS 5.3 · 1.7% likely

    Twilio

  2. ProFTPD 1.2.x - Username Enumeration via Timing AttackCVE-2004-160231% likely
  3. Thinfinity VirtualUI User EnumerationCVE-2021-4484823% likely
  4. Rocket.Chat <3.9.1 - Information DisclosureCVE-2020-2820811% likely
  5. Pritunl VPN Server 1.29.2145.25 - Username EnumerationCVE-2020-252007.5% likely
  6. AVM FRITZ!Box 7530 AX - Unauthorized AccessCVE-2024-54767CVSS 7.5 · 2.1% likely
  7. Hide My WP Ghost < 5.2.02 - Hidden Login Page DisclosureCVE-2024-6420Wpplugins · CVSS 8.6 · 1.8% likely
  8. Stop User Enumeration WordPress plugin - Authentication BypassCVE-2025-4302Fullworksplugins · CVSS 5.3 · 1.0% likely
  9. ownCloud Guests - User EnumerationCVE-2025-59716Owncloud · CVSS 5.3 · 1.0% likely

    ownCloud

  10. WPS Hide Login < 1.9.16.4 - Hidden Login Page DisclosureCVE-2024-6289Wpserveur · CVSS 6.1 · 0.9% likely
  11. Protect WP Admin < 4.0 - Unauthenticated Protection BypassCVE-2023-3139Protect WP Admin · 0.7% likely
  12. Discourse - Private Group Membership Inference via exclude_groupsCVE-2026-33425discourse · CVSS 6.9 · 0.7% likely

    Discourse

  13. Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a sid…CVE-2017-5753Intel Corporation · CVSS 5.6 · 94% likely

    Intel Corporation

  14. OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine v…CVE-2003-019077% likely
  15. Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access…CVE-2017-5715Intel Corporation · CVSS 5.6 · 73% likely

    Intel Corporation

  16. Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthor…CVE-2018-3639Intel Corporation · CVSS 5.5 · 60% likely

    Intel Corporation

  17. wolfSSL Bleichenbacher/ROBOTCVE-2017-13099wolfSSL · CVSS 7.5 · 27% likely

    wolfSSL

  18. BouncyCastle JCE TLS Bleichenbacher/ROBOTCVE-2017-13098Legion of the Bouncy Castle · CVSS 7.5 · 24% likely

    Legion of the Bouncy Castle Inc.

  19. Timing Oracle in RSA DecryptionCVE-2022-4304OpenSSL · CVSS 5.9 · 24% likelycovered by CyberSIXT

    OpenSSL

  20. The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages wi…CVE-2017-100038522% likely
  21. On BIG-IP versions 11.6.0-11.6.2 (fixed in 11.6.2 HF1), 12.0.0-12.1.2 HF1 (fixed in 12.1.2 HF2), or 13.0.0-13.0.0 HF2 (fixed in 13.0.0 HF3) a virtual server configured with a Clie…CVE-2017-616820% likely
  22. An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker t…CVE-2019-1651620% likely
  23. Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software RSA Private Key Leak VulnerabilityCVE-2022-20866Cisco · CVSS 7.4 · 18% likely

    Cisco

  24. 0-byte record padding oracleCVE-2019-1559OpenSSL · 17% likely

    OpenSSL

  25. Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable to an adaptive-chosen ciphertext attack ("Bleichenbacher attack"). This allows an attacker…CVE-2017-1742716% likely
  26. The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists.CVE-2021-4590114% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in