CWE-209— Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.— MITRE CWE catalog

678 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-209page 5 of 14

CVE-2021-23135MEDIUMCVSS 5.9EG 5.9
2021-05-12
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versi…
CVE-2019-11252MEDIUMCVSS 5.9EG 5.9
2020-07-23
The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.
CVE-2026-92936MEDIUMCVSS 5.8EG 5.8
2026-09-17
vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError (for example by calling eval…
CVE-2026-55102MEDIUMCVSS 5.8EG 5.8
2026-08-13
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosErro…
CVE-2026-44002MEDIUMCVSS 5.8EG 5.8
2026-05-13
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() t…
CVE-2025-46746MEDIUMCVSS 5.8EG 5.8
2025-05-12
An administrator could discover another account's credentials.
CVE-2025-0941MEDIUMCVSS 5.8EG 5.8
2025-02-26
MET ONE 3400+ instruments running software v1.0.41 can, under rare conditions, temporarily store credentials in plain text within the system. This data is not available to unauthenticated users.
CVE-2020-14337MEDIUMCVSS 5.8EG 5.8
2020-07-31
A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames…
CVE-2026-69552MEDIUMCVSS 5.7EG 5.7
2026-09-08
Generation of error message containing sensitive information in Windows Print Spooler Components allows an authorized attacker to disclose information over a network.
CVE-2026-85115MEDIUMCVSS 5.5EG 5.5
2026-10-13
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an…
CVE-2026-106123MEDIUMCVSS 5.5EG 5.5
2026-10-06
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI pa…
CVE-2026-69294MEDIUMCVSS 5.5EG 5.5
2026-09-08
Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally.
CVE-2026-68886MEDIUMCVSS 5.5EG 5.5
2026-09-08
Use after free in Windows Network Connection Broker allows an authorized attacker to disclose information locally.
CVE-2026-69684MEDIUMCVSS 5.5EG 5.5
2026-09-08
Generation of error message containing sensitive information in Windows Error Reporting allows an authorized attacker to disclose information locally.
CVE-2026-27004MEDIUMCVSS 5.5EG 5.5
2026-02-20
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in some shared-agent deployments, OpenClaw session tools (`sessions_list`, `sessions_history`, `sessions_send`) allowed broader session targeting than some operators intended…
CVE-2026-20838MEDIUMCVSS 5.5EG 5.5
2026-01-13
Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally.
CVE-2025-40760MEDIUMCVSS 5.5EG 5.5
2025-11-11
A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests. …
CVE-2025-55676MEDIUMCVSS 5.5EG 5.5
2025-10-14
Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose information locally.
CVE-2025-53803MEDIUMCVSS 5.5EG 5.5
2025-09-09
Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally.
CVE-2025-22421MEDIUMCVSS 5.5EG 5.5
2025-09-02
In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional e…
CVE-2025-5731MEDIUMCVSS 5.5EG 5.5
2025-06-26
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
CVE-2024-6613MEDIUMCVSS 5.5EG 5.5
2024-07-09
The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 and Thunderbird < 128.
CVE-2021-47381MEDIUMCVSS 5.5EG 5.5
2024-05-21
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Fix DSP oops stack dump output contents Fix @buf arg given to hex_dump_to_buffer() and stack address used in dump error output.
CVE-2021-47161MEDIUMCVSS 5.5EG 5.5
2024-03-25
In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-dspi: Fix a resource leak in an error handling path 'dspi_request_dma()' should be undone by a 'dspi_release_dma()' call in the error handling path of the p…
CVE-2023-0833MEDIUMCVSS 5.5EG 5.5
2023-09-27
A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attack…
CVE-2023-31429MEDIUMCVSS 5.5EG 5.5
2023-08-01
Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”, errmoduleshow, errfilterset, hassiscfgperrthreshold, supportshowcfgd…
CVE-2023-20593MEDIUMCVSS 5.5EG 5.5
2023-07-24
An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.
CVE-2023-21103MEDIUMCVSS 5.5EG 5.5
2023-05-15
In registerPhoneAccount of PhoneAccountRegistrar.java, uncaught exceptions in parsing persisted user data could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for e…
CVE-2021-3620MEDIUMCVSS 5.5EG 5.5
2022-03-03
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confi…
CVE-2022-0563MEDIUMCVSS 5.5EG 5.5
2022-02-21
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specifi…
CVE-2021-1546MEDIUMCVSS 5.5EG 5.5
2021-09-23
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to improper protections on file access through the CLI. An attacker could exploit t…
CVE-2019-12864MEDIUMCVSS 5.5EG 5.5
2020-05-04
SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via …
CVE-2019-4619MEDIUMCVSS 5.5EG 5.5
2020-03-16
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 168862.
CVE-2026-102904MEDIUMCVSS 5.4EG 5.4
2026-09-29
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHan…
CVE-2025-43776MEDIUMCVSS 5.4EG 5.4
2025-09-09
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 thr…
CVE-2024-35112MEDIUMCVSS 5.4EG 5.4
2025-01-25
IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVE-2024-39737MEDIUMCVSS 5.4EG 5.4
2024-07-15
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attack…
CVE-2023-50953MEDIUMCVSS 5.4EG 5.4
2024-06-30
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. IBM X-Force I…
CVE-2020-35177MEDIUMCVSS 5.3EG 5.4
2020-12-17
HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.
CVE-2021-27774MEDIUMCVSS 3.1EG 5.4
2022-09-22
User input included in error response, which could be used in a phishing attack.
CVE-2026-120971MEDIUMCVSS 5.3EG 5.3
2026-11-03
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500…
CVE-2026-105770MEDIUMCVSS 5.3EG 5.3
2026-11-03
Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and …
CVE-2026-116478MEDIUMCVSS 5.3EG 5.3
2026-10-26
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through er…
CVE-2026-101259MEDIUMCVSS 5.3EG 5.3
2026-10-26
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build i…
CVE-2026-114348MEDIUMCVSS 5.3EG 5.3
2026-10-22
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-editor endpoint validates the Host header with a regular expre…
CVE-2026-113705MEDIUMCVSS 5.3EG 5.3
2026-10-20
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack ca…
CVE-2026-3628MEDIUMCVSS 5.3EG 5.3
2026-10-19
IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.
CVE-2026-85315MEDIUMCVSS 5.3EG 5.3
2026-10-19
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed, …
CVE-2026-85257MEDIUMCVSS 5.3EG 5.3
2026-10-19
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer faile…
CVE-2026-85246MEDIUMCVSS 5.3EG 5.3
2026-10-19
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed, the M…

Map vulnerabilities like CWE-209 to your infrastructure

EchelonGraph correlates every CVE — across CWE-209 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →