CWE-201 · Information Disclosure
Insertion of Sensitive Information Into Sent Data
501CVEs
0exploited
13with a public check
0likely (EPSS 10%+)
SortMost likely exploited
501 CVEs with CWE-201 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-60188CheckAtarim < 4.2.2 - Sensitive Information ExposureVito Peleg · Atarim · CVSS 7.5 · 2025-11-06 | 7.5 | 3.7% | 2025-11-06 |
| CVE-2023-6444CheckSeriously Simple Podcasting < 3.0.0 - Information DisclosureCastos · Seriously Simple Podcasting · CVSS 5.3 · 2024-03-11 | 5.3 | 2.5% | 2024-03-11 |
| CVE-2026-24477CheckAnythingLLM - Information DisclosureMintplex-Labs · anything-llm · CVSS 8.7 · 2026-01-26 | 8.7 | 2.1% | 2026-01-26 |
| CVE-2024-32825CheckSimply Static - Information DisclosureSimply Static · Simply Static · CVSS 7.5 · 2024-04-24 | 7.5 | 2.0% | 2024-04-24 |
| CVE-2024-6586CheckLightdash v0.1024.6 - Server-Side Request ForgeryLightdash · Lightdash · CVSS 7.3 · 2024-08-30 | 7.3 | 1.9% | 2024-08-30 |
| CVE-2026-47717CheckFUXA 1.3.0 - Unauthenticated ICS/SCADA Project Data Disclosurefrangoteam · FUXA · CVSS 7.5 · 2026-08-12 | 7.5 | 1.4% | 2026-08-12 |
| CVE-2025-62039CheckAI ChatBot with ChatGPT by AYS <= 2.6.6 - Unauthenticated API Key ExposureAys Pro · AI ChatBot with ChatGPT and Content Generator by AYS · CVSS 7.5 · 2025-11-06 | 7.5 | 1.3% | 2025-11-06 |
| CVE-2026-27934CheckDiscourse < 2026.1.2/2026.2.1/2026.3.0-latest.1 - Unauthenticated Private User Action Disclosurediscourse · discourse · CVSS 8.7 · 2026-03-19 | 8.7 | 1.2% | 2026-03-19 |
| CVE-2024-43283CheckContest Gallery - Broken Access ControlWasiliy Strecker / ContestGallery developer · Contest Gallery · CVSS 5.3 · 2024-08-26 | 5.3 | 1.1% | 2024-08-26 |
| CVE-2025-24582Check12 Step Meeting List < 3.16.6 - Unauthenticated Sensitive Information ExposureAA Web Servant · 12 Step Meeting List · CVSS 5.3 · 2025-01-24 | 5.3 | 1.0% | 2025-01-24 |
| CVE-2025-58226CheckWordPress 3D FlipBook Plugin <= 1.16.17 - Sensitive Information Exposureiberezansky · 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery · CVSS 5.3 · 2025-09-22 | 5.3 | 0.7% | 2025-09-22 |
| CVE-2025-62126CheckWordPress Varnish/Nginx Proxy Caching <= 1.8.3 - Information ExposureRazvan Stanga · Varnish/Nginx Proxy Caching · CVSS 5.3 · 2025-12-31 | 5.3 | 0.7% | 2025-12-31 |
| CVE-2025-59136CheckWordPress Gerencianet Oficial <= 3.1.3 - Unauthenticated Order Status DisclosureEfí Bank · Gerencianet Oficial · CVSS 5.3 · 2025-12-31 | 5.3 | 0.7% | 2025-12-31 |
| CVE-2022-27779libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie…Siemens · https://github.com/curl/curl · 2022-06-01 | – | 2.8% | 2022-06-01 |
| CVE-2017-16026Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. Thi…HackerOne · request node module · 2018-06-04 | – | 2.5% | 2018-06-04 |
| CVE-2017-2582It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. T…Red Hat · keycloak · CVSS 6.5 · 2018-07-26 | 6.5 | 2.4% | 2018-07-26 |
| CVE-2020-26085Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCisco · Cisco Jabber · CVSS 9.9 · 2021-01-06 | 9.9 | 2.3% | 2021-01-06 |
| CVE-2016-10518A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by defau…HackerOne · ws node module · 2018-05-31 | – | 1.9% | 2018-05-31 |
| CVE-2013-1840Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image requestRed Hat · OpenStack Folsom for RHEL 6 · CVSS 6.5 · 2013-03-22 | 6.5 | 1.7% | 2013-03-22 |
| CVE-2020-27134Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCisco · Cisco Jabber · CVSS 9.9 · 2020-12-11 | 9.9 | 1.7% | 2020-12-11 |
| CVE-2016-10519A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal internal memory.HackerOne · bittorrent-dht node module · 2018-05-31 | – | 1.6% | 2018-05-31 |
| CVE-2020-25703The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.…Moodle · moodle · 2020-11-19 | – | 1.5% | 2020-11-19 |
| CVE-2025-58098Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...Apache Software Foundation · Apache HTTP Server · CVSS 8.3 · 2025-12-05 | 8.3 | 1.5% | 2025-12-05 |
| CVE-2018-17245Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests extern…Elastic · Kibana · 2018-12-20 | – | 1.5% | 2018-12-20 |
| CVE-2021-26566Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to exec…Synology · Synology DiskStation Manager (DSM) · CVSS 8.3 · 2021-02-26 | 8.3 | 1.5% | 2021-02-26 |
| CVE-2020-27132Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCisco · Cisco Jabber · CVSS 9.9 · 2020-12-11 | 9.9 | 1.4% | 2020-12-11 |
| CVE-2020-27748A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when bein…Freedesktop · xdg-utils · 2021-06-01 | – | 1.4% | 2021-06-01 |
| CVE-2020-27127Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCisco · Cisco Jabber · CVSS 9.9 · 2020-12-11 | 9.9 | 1.4% | 2020-12-11 |
| CVE-2023-34968Samba: spotlight server-side share path disclosureRed Hat · Red Hat Enterprise Linux 8 · CVSS 5.3 · 2023-07-20 | 5.3 | 1.3% | 2023-07-20 |
| CVE-2022-27671A CSRF token visible in the URL may possibly lead to information disclosure vulnerability.SAP SE · SAP BusinessObjects Business Intelligence Platform · 2022-04-12 | – | 1.3% | 2022-04-12 |
| CVE-2020-8975ZGR TPS200 NG Information ExposureZGR · ZGR TPS200 NG · CVSS 7.5 · 2022-10-17 | 7.5 | 1.3% | 2022-10-17 |
| CVE-2020-1770Information disclosure in support bundle filesOTRS AG · ((OTRS)) Community Edition · CVSS 2.4 · 2020-03-27 | 2.4 | 1.3% | 2020-03-27 |
| CVE-2024-50378Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cliApache Software Foundation · Apache Airflow · CVSS 4.9 · 2024-11-08 | 4.9 | 1.2% | 2024-11-08 |
| CVE-2023-49594An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead…instipod · DuoUniversalKeycloakAuthenticator · CVSS 4.5 · 2023-12-23 | 4.5 | 1.2% | 2023-12-23 |
| CVE-2021-32653Default settings leak federated cloud ID to lookup server of all usersnextcloud · security-advisories · CVSS 2.7 · 2021-06-01 | 2.7 | 1.2% | 2021-06-01 |
| CVE-2021-1129Cisco Email Security Appliance, Cisco Content Security Management Appliance, and Cisco Web Security Appliance Information Disclosure VulnerabilityCisco · Cisco Web Security Appliance (WSA) · CVSS 5.3 · 2021-01-20 | 5.3 | 1.2% | 2021-01-20 |
| CVE-2019-15580An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated…Gitlab · gitlab.com · 2019-12-18 | – | 1.1% | 2019-12-18 |
| CVE-2020-27133Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCisco · Cisco Jabber · CVSS 9.9 · 2020-12-11 | 9.9 | 1.1% | 2020-12-11 |
| CVE-2026-86409stale SigV4 headers sent unintendedcurl · curl · CVSS 8.1 · 2026-10-20 | 8.1 | 1.1% | 2026-10-20 |
| CVE-2026-87862HSTS cache import drops longer-lived childcurl · curl · CVSS 8.1 · 2026-10-20 | 8.1 | 1.0% | 2026-10-20 |
| CVE-2020-5364Dell EMC Isilon OneFS versions 8.2.2 and earlier contain an SNMPv2 vulnerability. The SNMPv2 services is enabled, by default, with a pre-configured community string. This communit…Dell · Isilon OneFS · CVSS 5.3 · 2020-05-20 | 5.3 | 1.0% | 2020-05-20 |
| CVE-2025-26318hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application.TSplus · TSplus Remote Access · CVSS 5.8 · 2025-03-04 | 5.8 | 1.0% | 2025-03-04 |
| CVE-2020-13597Calico nodes IPv6 traffic redirection from route advertismentTigera Inc · Calico · CVSS 6 · 2020-06-03 | 6.0 | 0.9% | 2020-06-03 |
| CVE-2026-65812Microsoft Teams for Android Information Disclosure VulnerabilityMicrosoft · Microsoft Teams for Android · CVSS 6.8 · 2026-09-08 | 6.8 | 0.9% | 2026-09-08 |
| CVE-2024-32782WordPress HT Mega plugin <= 2.4.7 - Sensitive Data Exposure vulnerabilityDevItems · HT Mega · CVSS 4.3 · 2024-04-24 | 4.3 | 0.9% | 2024-04-24 |
| CVE-2020-1774Information disclosureOTRS AG · ((OTRS)) Community Edition · CVSS 4.5 · 2020-04-28 | 4.5 | 0.9% | 2020-04-28 |
| CVE-2026-54649punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-ToPunchIn-App · punchin-email · CVSS 2.1 · 2026-09-17 | 2.1 | 0.8% | 2026-09-17 |
| CVE-2026-87863HSTS response erases persisted entriescurl · curl · CVSS 8.1 · 2026-10-20 | 8.1 | 0.8% | 2026-10-20 |
| CVE-2020-37150Edimax Technology EW-7438RPn-v3 Mini 1.27 - Unauthorized Access: Wi-Fi Password DisclosureEDIMAX Technology · EW-7438RPn-v3 Mini · CVSS 7.5 · 2026-02-05 | 7.5 | 0.8% | 2026-02-05 |
| CVE-2026-66822.NET Information Disclosure VulnerabilityMicrosoft · .NET 10.0 runtime · CVSS 5.9 · 2026-10-13 | 5.9 | 0.8% | 2026-10-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.