CWE-200: Exposure of sensitive information
11,917 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 18 of them as exploited in the wild.
- Published CVEs
- 11,917
- Last 12 months
- 2,562
- Critical
- 388
- Known exploited
- 18
Critical 388High 2,425Medium 7,794Low 1,303Not scored 7
CVEs per yearBy the year they were published
- 2015595
- 2016684
- 20171,312
- 20181,076
- 2019559
- 2020351
- 2021314
- 2022490
- 2023594
- 2024834
- 2025831
- 20262,438
Known exploitedNewest addition to KEV first
- CVE-2025-68686
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0…
Fortinet · FortiOS
ExploitedMedium5.3 - CVE-2026-20133
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This…
Cisco · Cisco Catalyst SD-WAN Manager
ExploitedMedium6.5 - CVE-2025-31125
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
vitejs · vite
ExploitedMedium5.3 - CVE-2026-20805
Desktop Window Manager Information Disclosure Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedMedium5.5 - CVE-2021-41277
GeoJSON URL validation can expose server files and environment variables to unauthorized users
metabase · metabase
ExploitedCritical10.0 - CVE-2024-24919
Information disclosure
checkpoint · Check Point Quantum Gateway, Spark Gateway and CloudGuard Network
ExploitedHigh8.6 - CVE-2023-21237
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI.…
Android
ExploitedMedium6.2 - CVE-2020-3259
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability
Cisco · Cisco Adaptive Security Appliance (ASA) Software
ExploitedHigh7.5 - CVE-2023-49103
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php…
Product not named
ExploitedCritical10.0 - CVE-2016-6415
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX…
Product not named
ExploitedHigh7.5
Newest CVEs
- CVE-2026-8642
IBM Verify Directory is affected by multiple vulnerabilities
IBM · Security Verify Directory
Medium4.3 - CVE-2026-108284
IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities
IBM · WebSphere Application Server - Liberty
Medium6.5 - CVE-2026-103320
IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities
IBM · WebSphere Application Server - Liberty
Medium4.3 - CVE-2026-124443
Frappe before 16.35.0 Broken Access Control in File List/Report Queries
frappe · frappe
Medium5.3 - CVE-2026-124438
Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access
scriban · scriban
Critical9.1 - CVE-2026-124434
Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions
getgrav · grav
High7.1 - CVE-2026-123504
Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members
go-vikunja · vikunja
Medium5.3 - CVE-2026-118801
aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode
kodezen · aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder
Medium4.3 - CVE-2026-93370
Paystack WooCommerce Payment Gateway <= 5.8.5 - Unauthenticated Sensitive Information Exposure in 'key' Parameter on order-pay Endpoint
paystack · Paystack WooCommerce Payment Gateway
Medium5.3 - CVE-2026-121380
Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API
Unknown · Tournamatch
Medium5.3