CWE-402 · Denial of Service
Transmission of Private Resources into a New Sphere
23CVEs
SortMost likely exploited
23 CVEs with CWE-402 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-29925CheckXWiki REST API - Private Pages Disclosurexwiki · xwiki-platform · CVSS 8.7 · 2025-03-19 | 8.7 | 0.9% | 2025-03-19 |
| CVE-2021-31407Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19Vaadin · Vaadin · CVSS 8.6 · 2021-04-23 | 8.6 | 2.4% | 2021-04-23 |
| CVE-2021-31410Project sources exposure in Vaadin DesignerVaadin · Designer · CVSS 8.6 · 2021-04-23 | 8.6 | 1.8% | 2021-04-23 |
| CVE-2021-23263Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter EngineCrafter Software · Crafter CMS · CVSS 5.9 · 2021-12-02 | 5.9 | 1.7% | 2021-12-02 |
| CVE-2021-23264Transmission of Private Resources into a New Sphere ('Resource Leak') and Exposure of Resource to Wrong Sphere in Crafter SearchCrafter Software · Crafter CMS · CVSS 8.1 · 2021-12-02 | 8.1 | 1.2% | 2021-12-02 |
| CVE-2022-3596Instack-undercloud: rsync leaks information to undercloudRed Hat · Red Hat OpenStack Platform 13.0 - ELS · CVSS 7.5 · 2023-09-20 | 7.5 | 1.1% | 2023-09-20 |
| CVE-2024-32388Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted UDP packets. This allows an attacker to bypass the firewall an…Kerlink · Keros · CVSS 5.3 · 2025-12-01 | 5.3 | 1.0% | 2025-12-01 |
| CVE-2023-34467XWiki Platform may retrieve email addresses of all usersxwiki · xwiki-platform · CVSS 7.5 · 2023-06-23 | 7.5 | 1.0% | 2023-06-23 |
| CVE-2017-8442Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and…Elastic · Elasticsearch X-Pack Security · 2017-07-07 | – | 0.9% | 2017-07-07 |
| CVE-2023-38509XWiki Platform's obfuscated email addresses should not be sortedxwiki · xwiki-platform · CVSS 4.3 · 2023-07-27 | 4.3 | 0.8% | 2023-07-27 |
| CVE-2024-29900@electron/packager's build process memory potentially leaked into final executableelectron · packager · CVSS 7.5 · 2024-03-29 | 7.5 | 0.6% | 2024-03-29 |
| CVE-2022-30231A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application discloses password hashes of other users upon request. This could…Siemens · SICAM GridEdge (Classic) · CVSS 4.9 · 2022-06-14 | 4.9 | 0.6% | 2022-06-14 |
| CVE-2025-0502Transmission of Private Resources into a New Sphere in Crafter EngineCrafterCMS · CrafterCMS · CVSS 6.9 · 2025-01-15 | 6.9 | 0.5% | 2025-01-15 |
| CVE-2025-55014The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the dict.youdao.com and dict.cn servers via…StarDict · StarDict · CVSS 4.7 · 2025-08-04 | 4.7 | 0.4% | 2025-08-04 |
| CVE-2025-49618In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.Plesk · Obsidian · CVSS 5.8 · 2025-07-03 | 5.8 | 0.4% | 2025-07-03 |
| CVE-2025-48383Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leakingcodingjoe · django-select2 · CVSS 8.2 · 2025-05-27 | 8.2 | 0.3% | 2025-05-27 |
| CVE-2025-66422Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.Tryton · trytond · CVSS 4.3 · 2025-11-30 | 4.3 | 0.3% | 2025-11-30 |
| CVE-2024-47146Ruijie Reyee OS Resource LeakRuijie · Reyee OS · CVSS 6.5 · 2024-12-06 | 6.5 | 0.3% | 2024-12-06 |
| CVE-2023-4569Kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.cLinux · Kernel · CVSS 5.5 · 2023-08-28 | 5.5 | 0.3% | 2023-08-28 |
| CVE-2025-32360In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see det…Zammad · Zammad · CVSS 4.2 · 2025-04-05 | 4.2 | 0.3% | 2025-04-05 |
| CVE-2024-0443Kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline.Redhat · kernel · CVSS 5.5 · 2024-01-11 | 5.5 | 0.2% | 2024-01-11 |
| CVE-2025-52925In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812.OneLogin · Active Directory Connector · CVSS 5 · 2025-07-02 | 5.0 | 0.2% | 2025-07-02 |
| CVE-2025-67745Myhoard logs backup encryption key in plain textAiven-Open · myhoard · CVSS 7.1 · 2025-12-18 | 7.1 | 0.2% | 2025-12-18 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.