CWE-359

218 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 2High 72Medium 116Low 28Not scored 0

CVEs per yearBy the year they were published

CVE-2026-111753
Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
angular · angular
Medium5.9
CVE-2026-54144
OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture
tinyhumansai · openhuman
Medium6.1
CVE-2026-85916
Azure Active Directory Information Disclosure Vulnerability
Microsoft · Windows 11 version 23H2
Medium6.2
CVE-2026-102579
Moodle: user profile information disclosure via grade web service
moodle
Medium4.3
CVE-2026-39372
InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments
InvoicePlane · InvoicePlane
Medium4.9
CVE-2026-54565
rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages
edwardkim · rhwp
Medium4.7
CVE-2026-61588
djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client
djust-org · djust
Medium6.5
CVE-2026-92565
Rallly before 4.15.0 Information Disclosure via polls.get
lukevella · rallly
Medium6.9
CVE-2026-76855
Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints
Netcore · NR255-V
High7.1
CVE-2026-86904
A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be…
Apple · iOS and iPadOS
High7.5