CWE-209: Sensitive information in an error message

674 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 3 of them as exploited in the wild.

Critical 31High 74Medium 469Low 99Not scored 1

CVEs per yearBy the year they were published

CVE-2025-47813
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
wftpserver · Wing FTP Server
ExploitedMedium4.3
CVE-2024-29059
.NET Framework Information Disclosure Vulnerability
Microsoft · Microsoft .NET Framework 4.8
ExploitedHigh7.5
CVE-2013-7331
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share…
Product not named
ExploitedMedium6.5

CVE-2026-17215
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Medium4.3
CVE-2026-17114
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Medium5.4
CVE-2026-17098
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Medium5.3
CVE-2026-73101
Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults
Apache Software Foundation · Apache Juneau
Critical10.0
CVE-2026-123036
A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field is…
Red Hat · ansible-core
Medium5.5
CVE-2026-105702
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM · Db2 Genius Hub
Medium4.3
CVE-2026-91163
Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller
warp-tech · warpgate
Low3.7
CVE-2026-112244
Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points
Unknown · Duplicator
Medium5.3
CVE-2026-120971
Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses
Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3
Medium5.3
CVE-2026-105770
Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages
octo-sts · app
Medium5.3