CWE-201 Insertion of Sensitive Information Into Sent Data

GitHub CLI partially discloses authentication tokens in `gh auth status` output

Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability

Docling: Configured HTTP headers sent to every remote image host named by a document

Backstage: Sensitive information exposure in Scaffolder

Payload vulnerable to API key disclosure through ordinary document reads

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Hurl: Cookies in Cookies section leak when redirecting to a different host

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations

Guzzle: Host-only cookie scope is not preserved

Duplicate Advisory: Guzzle: Host-only cookie scope is not preserved

Guzzle: URI fragments disclosed in redirect Referer headers

Duplicate Advisory: Guzzle: URI fragments disclosed in redirect Referer headers

Guzzle: Proxy-Authorization headers can be sent to origin servers

Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

Next.js: Unauthenticated disclosure of internal Server Function endpoints

Excon does not redact additional sensitive/risky headers when following redirects

HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization

MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

neotoma has tenant isolation gap in relationship query endpoints

OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet