Skip to content
BackEsc
Sign in

CWE-209 · weakness in Information Disclosure

Generation of Error Message Containing Sensitive Information

632 CVEs · 3 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
3
check available
5
likely to be exploited
5

Every one of the 632 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. .NET Framework - Leaking ObjRefs via HTTP .NET RemotingCVE-2024-29059Microsoft · CVSS 7.5 · 99% likely

    Microsoft

  2. Wing FTP Server <= 7.4.3 - Path Disclosure via Overlong UID CookieCVE-2025-47813wftpserver · CVSS 4.3 · 63% likelycovered by CyberSIXT

    Wftpserver

  3. The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet host…CVE-2013-7331Microsoft · CVSS 6.5 · 50% likely

    Microsoft

  4. Drupal 11.x-dev - Full Path DisclosureCVE-2024-45440Drupal · CVSS 5.3 · 9.3% likely

    Drupal

  5. Microweber <1.2.11 - Information DisclosureCVE-2022-0660microweber · CVSS 9.4 · 6.9% likely

    Microweber

  6. ReadToMyShoe - Generation of Error Message Containing Sensitive InformationCVE-2023-27587rozbb · CVSS 7.4 · 3.9% likely
  7. Usermin 2.100 - Username EnumerationCVE-2024-44762Webmin · CVSS 5.3 · 2.6% likely

    Webmin

  8. Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)CVE-2023-5089Defender Security · CVSS 5.3 · 2.5% likely
  9. Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error code…CVE-2010-333268% likely
  10. SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing files to which the…CVE-2021-30357SSL Network Extender Client for Linux · 23% likely
  11. Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPM…CVE-2021-3115918% likely
  12. In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the er…CVE-2020-1188315% likely
  13. Apache Tomcat: Leaking of unrelated request bodies in default error pageCVE-2024-21733Apache Software Foundation · CVSS 5.3 · 14% likely

    Apache

  14. Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an inco…CVE-2018-1796110.0% likely
  15. Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by defaultCVE-2026-29146Apache Software Foundation · CVSS 7.5 · 8.8% likely

    Apache

  16. apisix/jwt-auth may leak secrets in error responseCVE-2022-29266Apache Software Foundation · 8.1% likely

    Apache

  17. An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.CVE-2023-20593AMD · 5.1% likely

    AMD

  18. The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors.CVE-2020-154784.7% likely
  19. An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter that does not exist,…CVE-2024-39719Ollama · CVSS 7.5 · 4.2% likely

    Ollama

  20. In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and…CVE-2018-12536The Eclipse Foundation · 4.2% likely

    Eclipse Foundation

  21. A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user i…CVE-2021-22885https://github.com/rails/rails · 4.0% likely
  22. An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after either a form validation error or navigating to a previous i…CVE-2018-113253.1% likely
  23. Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure Through an Error Message vulnerability. Successful exploitation could lead to Informa…CVE-2019-7941Adobe Campaign · 3.1% likely
  24. htsearch program in htDig 3.2 beta, 3.1.6, 3.1.5, and earlier allows remote attackers to determine the physical path of the server by requesting a non-existent configuration file…CVE-2000-11913.0% likely
  25. IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a specially crafted url causes a stack tra…CVE-2019-4269IBM · CVSS 5.3 · 2.7% likely

    IBM

  26. stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction se…CVE-2018-128862.7% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in