CWE-209— Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.— MITRE CWE catalog
696 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-209page 5 of 14
- CVE-2016-9459MEDIUMCVSS 6.1EG 6.12017-03-28
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to th…
- CVE-2020-25778MEDIUMCVSS 6.0EG 6.02020-10-14
Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in a specific kernel extension where an attacker could supply a kernel pointer and leak several bytes of memory. An attacker must first obtain the ability to execute high-pr…
- CVE-2024-23945MEDIUMCVSS 5.9EG 5.92024-12-23
Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to secur…
- CVE-2023-47152MEDIUMCVSS 5.9EG 5.92024-01-22
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in stack trace under exceptional conditions.
- CVE-2022-31023MEDIUMCVSS 5.9EG 5.92022-06-02
Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, i…
- CVE-2021-23135MEDIUMCVSS 5.9EG 5.92021-05-12
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versi…
- CVE-2019-11252MEDIUMCVSS 5.9EG 5.92020-07-23
The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.
- CVE-2026-125328MEDIUMCVSS 5.8EG 5.82026-11-10
pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHe…
- CVE-2026-125326MEDIUMCVSS 5.8EG 5.82026-11-10
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, …
- CVE-2026-92936MEDIUMCVSS 5.8EG 5.82026-09-17
vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError (for example by calling eval…
- CVE-2026-55102MEDIUMCVSS 5.8EG 5.82026-08-13
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosErro…
- CVE-2026-44002MEDIUMCVSS 5.8EG 5.82026-05-13
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() t…
- CVE-2025-46746MEDIUMCVSS 5.8EG 5.82025-05-12
An administrator could discover another account's credentials.
- CVE-2025-0941MEDIUMCVSS 5.8EG 5.82025-02-26
MET ONE 3400+ instruments running software v1.0.41 can, under rare conditions, temporarily store credentials in plain text within the system. This data is not available to unauthenticated users.
- CVE-2020-14337MEDIUMCVSS 5.8EG 5.82020-07-31
A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames…
- CVE-2026-69552MEDIUMCVSS 5.7EG 5.72026-09-08
Generation of error message containing sensitive information in Windows Print Spooler Components allows an authorized attacker to disclose information over a network.
- CVE-2026-123036MEDIUMCVSS 5.5EG 5.52026-11-05
A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field is retained because it is present in the PRESERVE allow-list in lib/ansible/_internal/_t…
- CVE-2026-85115MEDIUMCVSS 5.5EG 5.52026-10-13
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an…
- CVE-2026-106123MEDIUMCVSS 5.5EG 5.52026-10-06
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI pa…
- CVE-2026-69294MEDIUMCVSS 5.5EG 5.52026-09-08
Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally.
- CVE-2026-68886MEDIUMCVSS 5.5EG 5.52026-09-08
Use after free in Windows Network Connection Broker allows an authorized attacker to disclose information locally.
- CVE-2026-69684MEDIUMCVSS 5.5EG 5.52026-09-08
Generation of error message containing sensitive information in Windows Error Reporting allows an authorized attacker to disclose information locally.
- CVE-2026-27004MEDIUMCVSS 5.5EG 5.52026-02-20
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in some shared-agent deployments, OpenClaw session tools (`sessions_list`, `sessions_history`, `sessions_send`) allowed broader session targeting than some operators intended…
- CVE-2026-20838MEDIUMCVSS 5.5EG 5.52026-01-13
Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally.
- CVE-2025-40760MEDIUMCVSS 5.5EG 5.52025-11-11
A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests. …
- CVE-2025-55676MEDIUMCVSS 5.5EG 5.52025-10-14
Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose information locally.
- CVE-2025-53803MEDIUMCVSS 5.5EG 5.52025-09-09
Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally.
- CVE-2025-22421MEDIUMCVSS 5.5EG 5.52025-09-02
In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional e…
- CVE-2025-5731MEDIUMCVSS 5.5EG 5.52025-06-26
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
- CVE-2024-6613MEDIUMCVSS 5.5EG 5.52024-07-09
The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 and Thunderbird < 128.
- CVE-2021-47381MEDIUMCVSS 5.5EG 5.52024-05-21
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Fix DSP oops stack dump output contents Fix @buf arg given to hex_dump_to_buffer() and stack address used in dump error output.
- CVE-2021-47161MEDIUMCVSS 5.5EG 5.52024-03-25
In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-dspi: Fix a resource leak in an error handling path 'dspi_request_dma()' should be undone by a 'dspi_release_dma()' call in the error handling path of the p…
- CVE-2023-0833MEDIUMCVSS 5.5EG 5.52023-09-27
A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attack…
- CVE-2023-31429MEDIUMCVSS 5.5EG 5.52023-08-01
Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”, errmoduleshow, errfilterset, hassiscfgperrthreshold, supportshowcfgd…
- CVE-2023-20593MEDIUMCVSS 5.5EG 5.52023-07-24
An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.
- CVE-2023-21103MEDIUMCVSS 5.5EG 5.52023-05-15
In registerPhoneAccount of PhoneAccountRegistrar.java, uncaught exceptions in parsing persisted user data could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for e…
- CVE-2021-3620MEDIUMCVSS 5.5EG 5.52022-03-03
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confi…
- CVE-2022-0563MEDIUMCVSS 5.5EG 5.52022-02-21
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specifi…
- CVE-2021-1546MEDIUMCVSS 5.5EG 5.52021-09-23
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to improper protections on file access through the CLI. An attacker could exploit t…
- CVE-2019-12864MEDIUMCVSS 5.5EG 5.52020-05-04
SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via …
- CVE-2019-4619MEDIUMCVSS 5.5EG 5.52020-03-16
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 168862.
- CVE-2026-102904MEDIUMCVSS 5.4EG 5.42026-09-29
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHan…
- CVE-2025-43776MEDIUMCVSS 5.4EG 5.42025-09-09
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 thr…
- CVE-2024-35112MEDIUMCVSS 5.4EG 5.42025-01-25
IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- CVE-2024-39737MEDIUMCVSS 5.4EG 5.42024-07-15
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attack…
- CVE-2023-50953MEDIUMCVSS 5.4EG 5.42024-06-30
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. IBM X-Force I…
- CVE-2020-35177MEDIUMCVSS 5.3EG 5.42020-12-17
HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.
- CVE-2021-27774MEDIUMCVSS 3.1EG 5.42022-09-22
User input included in error response, which could be used in a phishing attack.
- CVE-2026-128075MEDIUMCVSS 5.3EG 5.32026-11-13
Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.4, Nuxt wraps non-HTTP errors thrown during server rendering with createError and incorrectly treats the result as an error deliberately exposed by the appli…
- CVE-2026-126991MEDIUMCVSS 5.3EG 5.32026-11-12
The Wikidata Lookup expansion module (wiki.py) in MISP misp-modules contained a SPARQL injection vulnerability. The handler function constructed a SPARQL query by directly concatenating the user-supplied text value into the query string wi…
Map vulnerabilities like CWE-209 to your infrastructure
EchelonGraph correlates every CVE — across CWE-209 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →