CWE-200— Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.— MITRE CWE catalog

12,076 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-200page 1 of 242

CVE-2023-49103CRITICALCVSS 7.5EG 10.0⚠ KEV
2023-11-21
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration d…
CVE-2013-0632CRITICALCVSS 9.8EG 9.8⚠ KEV
2013-01-17
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this se…
CVE-2008-0655CRITICALCVSS 8.8EG 9.8⚠ KEV
2008-02-07
Multiple unspecified vulnerabilities in Adobe Reader and Acrobat before 8.1.2 have unknown impact and attack vectors.
CVE-2015-0310CRITICALCVSS 7.8EG 9.8⚠ KEV
2015-01-23
Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protectio…
CVE-2018-5430CRITICALCVSS 8.8EG 9.0⚠ KEV
2018-04-17
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Repo…
CVE-2015-4495CRITICALCVSS 8.8EG 9.0⚠ KEV
2015-08-08
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted…
CVE-2024-24919CRITICALCVSS 8.6EG 9.0⚠ KEV
2024-05-28
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerabil…
CVE-2017-5521CRITICALCVSS 8.1EG 9.0⚠ KEV
2017-01-17
An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management…
CVE-2026-20133CRITICALCVSS 7.5EG 9.0⚠ KEV
2026-02-25
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated …
CVE-2023-28432CRITICALCVSS 7.5EG 9.0⚠ KEV
2023-03-22
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO…
CVE-2021-41277CRITICALCVSS 7.5EG 9.0⚠ KEV
2021-11-17
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (includi…
CVE-2021-22506CRITICALCVSS 7.5EG 9.0⚠ KEV
2021-03-26
Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage.
CVE-2020-3259CRITICALCVSS 7.5EG 9.0⚠ KEV
2020-05-06
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected …
CVE-2019-1653CRITICALCVSS 7.5EG 9.0⚠ KEV
2019-01-24
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to impro…
CVE-2017-0147CRITICALCVSS 7.5EG 9.0⚠ KEV
2017-03-17
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote at…
CVE-2016-6415CRITICALCVSS 7.5EG 9.0⚠ KEV
2016-09-19
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory…
CVE-2013-0631CRITICALCVSS 7.5EG 9.0⚠ KEV
2013-01-09
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.
CVE-2022-20821CRITICALCVSS 6.5EG 9.0⚠ KEV
2022-05-26
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM…
CVE-2019-5591CRITICALCVSS 6.5EG 9.0⚠ KEV
2020-08-14
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
CVE-2017-0022CRITICALCVSS 6.5EG 9.0⚠ KEV
2017-03-17
Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly …
CVE-2016-3298CRITICALCVSS 6.5EG 9.0⚠ KEV
2016-10-14
Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site…
CVE-2016-3351CRITICALCVSS 6.5EG 9.0⚠ KEV
2016-09-14
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
CVE-2013-7331CRITICALCVSS 6.5EG 9.0⚠ KEV
2014-02-26
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, a…
CVE-2021-25369CRITICALCVSS 6.2EG 9.0⚠ KEV
2021-03-26
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.
CVE-2025-68686CRITICALCVSS 5.9EG 9.0⚠ KEV
2026-02-10
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all v…
CVE-2026-20805CRITICALCVSS 5.5EG 9.0⚠ KEV
2026-01-13
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
CVE-2023-21237CRITICALCVSS 5.5EG 9.0⚠ KEV
2023-06-28
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution priv…
CVE-2021-31955CRITICALCVSS 5.5EG 9.0⚠ KEV
2021-06-08
Windows Kernel Information Disclosure Vulnerability
CVE-2016-4655CRITICALCVSS 5.5EG 9.0⚠ KEV
2016-08-25
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.
CVE-2025-31125CRITICALCVSS 5.3EG 9.0⚠ KEV
2025-03-31
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option…
CVE-2016-2388CRITICALCVSS 5.3EG 9.0⚠ KEV
2016-02-16
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
CVE-2017-0059CRITICALCVSS 4.3EG 9.0⚠ KEV
2017-03-17
Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." This vulnerability is different from …
CVE-2016-0162CRITICALCVSS 4.3EG 9.0⚠ KEV
2016-04-12
Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explorer Information Disclosure Vulnerability."
CVE-2026-92960CRITICALCVSS 10.0EG 10.0
2026-09-17
vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host pr…
CVE-2026-92947CRITICALCVSS 10.0EG 10.0
2026-09-17
vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring Arr…
CVE-2026-70478CRITICALCVSS 10.0EG 10.0
2026-08-04
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The en…
CVE-2026-27604CRITICALCVSS 10.0EG 10.0
2026-06-23
FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API role handling allows unauthenticated access to privileged `/api/system/*` end…
CVE-2026-40965CRITICALCVSS 10.0EG 10.0
2026-06-01
Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve) private keys are inadvertently exposed through the public /token_keys endpoint. Th…
CVE-2026-42826CRITICALCVSS 10.0EG 10.0
2026-05-07
Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network.
CVE-2025-29270CRITICALCVSS 10.0EG 10.0
2025-10-31
Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin panel and complete control of the device.
CVE-2025-61481CRITICALCVSS 10.0EG 10.0
2025-10-27
An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrator’s browser and intercept crede…
CVE-2025-53624CRITICALCVSS 10.0EG 10.0
2025-07-09
The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in producti…
CVE-2025-22612CRITICALCVSS 10.0EG 10.0
2025-01-24
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.374, the missing authorization allows an authenticated user to retrieve any existing private keys on a coolify …
CVE-2022-29165CRITICALCVSS 10.0EG 10.0
2022-05-20
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 and prior to versions 2.1.15, 2.2.9, and 2.3.4 which would allow unauthenticated …
CVE-2021-34679CRITICALCVSS 10.0EG 10.0
2021-06-11
Thycotic Password Reset Server before 5.3.0 allows credential disclosure.
CVE-2017-2320CRITICALCVSS 10.0EG 10.0
2017-04-24
A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause various denials of services leading to targeted informat…
CVE-2015-0987CRITICALCVSS 10.0EG 10.0
2015-10-06
Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain sensitive information by sniffing the network during a PLC…
CVE-2023-6248CRITICALCVSS 9.8EG 10.0
2023-11-21
The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code on any Syrus4 device connected to the cloud service. The MQTT server also leaks…
CVE-2014-9162HIGHCVSS v2 10.0EG 10.0
2014-12-10
Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to obtain sensitive information via unspecified vectors.
CVE-2013-0693HIGHCVSS v2 10.0EG 10.0
2013-10-03
The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier performs network-beacon broadcasts, which allows …

Map vulnerabilities like CWE-200 to your infrastructure

EchelonGraph correlates every CVE — across CWE-200 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →