CWE-209 vulnerabilities

CVE-2026-91882 is a high-severity vulnerability in Dell Terraform Provider for OME versions 1.0.0 through 1.2.3. It involves the generation of error messages that contain sensitive information due to improper error handling in the API client component. An unauthenticated remote attacker could exploit this flaw to gain access to sensitive data. The vulnerability is classified under CWE-209, which relates to information exposure through error messages.

CVE-2026-86607 is an internal application information exposure vulnerability in Hitachi Ops Center Administrator versions before 11.0.9-01. It involves generation of error messages that contain sensitive information, potentially leaking internal application details. The vulnerability has a medium severity with a CVSS score of 4.3. No known exploits are reported in the wild. The affected versions are all releases from initial up to but not including 11.0.9-01.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 contain an information disclosure vulnerability (CWE-209) that allows an authenticated attacker to obtain sensitive information when the restConnector-2.0 feature is enabled. The vulnerability involves generation of error messages that expose sensitive data. The CVSS 3.1 base score is 6.5, indicating a medium severity issue.

CVE-2026-83786 is a vulnerability in Microsoft Windows 10 NTFS that causes generation of error messages containing sensitive information. This flaw allows an authorized local attacker to disclose sensitive information through error messages. The vulnerability affects multiple Windows 10 versions prior to specific fixed releases. A patch is available from Microsoft to address this issue.

CVE-2026-85115 is a medium severity vulnerability in Siemens .NET Client Library for SIMATIC S7 Webserver API versions prior to 3.3.62. The flaw involves improper redaction of PLC restore passwords in HTTP error exception messages, potentially exposing sensitive credentials in logs or diagnostic outputs. This exposure could allow an attacker with access to such outputs to obtain plaintext restore passwords and perform unauthorized operations on the PLC.

CVE-2026-105283 is a vulnerability in ash-project's ash_typescript component that allows unauthenticated attackers to obtain sensitive internal Elixir terms from RPC error responses. This occurs because certain error cases are rendered without redaction, exposing internal data in client-facing error messages. The issue affects versions from 0.1.0 up to but not including 0.19.1.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 have a vulnerability where error messages may disclose sensitive information. This issue allows an unauthenticated remote attacker to potentially gain information disclosure. The vulnerability is classified as CWE-209 and has a low CVSS score of 3.7.

A vulnerability in the RabbitMQ Java client library prior to version 5.35.0 causes sensitive information, including plaintext usernames and passwords from AMQP URIs, to be included in error messages when URI parsing fails. This can lead to unintended disclosure of broker credentials in logs and monitoring systems. The issue is addressed in version 5.35.0.

HCL BigFix Service Management has an information disclosure vulnerability where sensitive information is returned in error messages when invalid inputs are sent to certain API endpoints. This exposure could potentially aid attackers in crafting further attacks. The vulnerability has a low severity score of 3.7 and does not involve privilege or user interaction requirements.

HCL BigFix Service Management contains an information disclosure vulnerability due to an exposed API endpoint that reveals sensitive internal database information. This exposure could allow unauthorized actors to gain data that might assist in launching targeted database attacks. The vulnerability has a CVSS score of 5.3, indicating a medium severity level.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks.

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks.

PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented placeholder variable, %windowspassword, which resolves to the configured Windows/domain password used by PRTG and can be passed as a sensor parameter.  Any PRTG user who is not restricted to read-only access and is permitted to create sensors (the default for non-read-only users) can pass %windowspassword as an argument to the demo VBScript sensor, triggering the type-mismatch error and causing PRTG to display the plaintext password in the sensor's error output.

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

CVE-2026-85709 is a vulnerability in HKUDS LightRAG prior to version 1.5.5 where error messages returned by the API server expose sensitive information. These error messages include raw Python exception text revealing server filesystem paths, database connection details including host, port, user, and database names, language model provider diagnostics, configuration details, and Python library internals. The default unauthenticated configuration allows these detailed error responses to be accessed without credentials, potentially exposing connection strings with credentials depending on the backend driver error. This issue is fixed in version 1.5.5.

IBM Common Licensing versions 9.0, 9.0.0.1, 9.0.0.2, and ART 9.0 series generate error messages that disclose sensitive information about their environment, users, or associated data. This information exposure vulnerability is identified as CWE-209. The issue has a medium severity with a CVSS score of 4.3. No specific affected versions are detailed, and no patch or remediation information is provided.

CVE-2025-1350 is a vulnerability in IBM Controller versions 11.0.0 and 11.1.0 where detailed technical error messages containing sensitive information are exposed to remote attackers via the browser. This exposure could aid attackers in further compromising the system. The vulnerability has a medium severity with a CVSS score of 5.3.

CVE-2026-45723 is an improper input validation vulnerability in siderolabs omni prior to versions 1.6.6 and 1.7.3. An authenticated Operator can manipulate the TalosVersion field to cause the application to issue HTTP GET requests to unintended paths on the configured image-factory host. This can lead to same-host endpoint probing and possible disclosure of internal diagnostic information. The vulnerability does not allow redirection to other hosts or write operations. The issue is fixed in versions 1.6.6 and 1.7.3.

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets. An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant. This issue is fixed in version 3.0.0.