CWE-201 vulnerabilities

A vulnerability in SecureDrop versions 2.13.0 through 2.16.0 allows sensitive Onion Service client authentication credentials to be copied to the Monitor Server when the securedrop-admin install Ansible playbook is run with journalist alerts disabled. This occurs because the journalist alert key filename is left empty, causing all files in the configuration directory to be transferred. The issue is fixed in version 2.16.1.

In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint

A vulnerability in Angular's HttpClient xsrfInterceptorFn prior to versions 20.3.34 and 21.0.3 allows an attacker to cause the X-XSRF-TOKEN header to be attached to cross-origin requests. This occurs because the interceptor uses a regular expression that does not normalize URLs like the browser's parser, leading to misclassification of attacker-controlled URLs with backslashes or whitespace as same-origin. An attacker can exploit this to obtain the victim's XSRF token and perform cross-site request forgery if permissive CORS policies are in place. The issue is fixed in Angular versions 20.3.34 and 21.0.3.

Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.

Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,

Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.

Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.

CVE-2026-107268 is a vulnerability in the Drupal Two Factor Authentication - TFA / Passwordless Login module that allows insertion of sensitive information into sent data, enabling forceful browsing. It affects versions from 0.0.0 up to 5.4.1 and from 5.5.0 up to 5.5.2. The issue has been fixed in versions 5.4.1 and 5.5.2. The vulnerability has a medium severity with a CVSS score of 4.3.

OpenAM versions prior to 16.1.1 have a vulnerability in the Cross-Domain Single Sign-On (CDSSO) servlet that allows an attacker to obtain a logged-in user's raw session token by inducing the user to visit a crafted URL. This can lead to session hijacking if CDSSO is enabled and certain non-default configurations are not in place. The issue is fixed in version 16.1.1.

CVE-2026-118083 is a vulnerability in Themeum's WP Crowdfunding plugin versions up to 2.2.2 that allows unauthenticated attackers to cause sensitive data exposure by inserting sensitive information into sent data. This flaw does not require user interaction or privileges and has a high severity rating.

CVE-2026-114173 is a vulnerability in the Ortto plugin for WordPress versions before 1.0.25. The plugin failed to filter WooCommerce product data embedded in public storefront pages, allowing unauthenticated attackers to access product passwords and private metadata. This issue was fixed in version 1.0.25.

A vulnerability in follow-redirects versions 1.16.0 through 1.16.1 allows sensitive headers to be incorrectly handled when following cross-origin redirects. The sensitiveHeaders option is checked using value instanceof Array, which fails for arrays created in different JavaScript realms, causing the list to be replaced with an empty array. As a result, custom credential headers intended to be protected can be forwarded to attacker-controlled redirect destinations. This issue is fixed in version 1.16.2.

A high-severity out-of-bounds read vulnerability exists in the odhcpd DHCPv6 IA parser used by OpenWrt. Versions from 17.01.0 up to but not including 25.12.3 improperly handle IA_NA or IA_PD options with bodies shorter than expected, leading to reading adjacent stack memory. This can disclose sensitive stack data such as stack canaries and ASLR-related information. The issue is fixed in version 25.12.3.

CVE-2026-114485 is a vulnerability in Devolutions Server versions up to 2026.3.10.0 that allows an authenticated attacker with delegated user view permissions to access MFA secrets of all users via the user list API. The issue stems from insufficient protection of sensitive information in the user list endpoint. A fix is available in version 2026.3.11.

A vulnerability in GitLab CE/EE versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 allowed an unauthenticated user to retrieve sensitive internal server credentials due to improper filtering of internal response headers. This issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.

CVE-2026-87863 is a high-severity vulnerability in curl where an authenticated HTTPS origin can supply an HSTS max-age value that causes a failure in time serialization on 64-bit systems. This failure leads to truncation and loss of the HSTS cache file during save operations, but curl exits successfully without reporting the error, resulting in silent data loss.

CVE-2026-87862 is a high-severity vulnerability in curl related to the handling of HSTS policies. When a parent HSTS entry with the includeSubDomains flag is imported before a longer-lived child entry, the child entry is silently dropped. This causes the loss of the child's valid HSTS policy when the parent expires, leading curl to downgrade from HTTPS to unencrypted HTTP requests.

CVE-2026-87861 is a critical vulnerability in curl where HTTP requests using ambient user credentials may be sent over a connection authenticated for a different origin. This causes the request to use the wrong credentials, potentially exposing sensitive information.

CVE-2026-86415 is a vulnerability in libcurl's connection cache match function where the automatic client certificate option is not considered. This can cause a cached, authenticated Schannel connection to be reused for a redirected transfer to a different origin, even if the auto client certificate option was disabled for that transfer. This behavior can lead to insertion of sensitive information into sent data.