CWE-209 Generation of Error Message Containing Sensitive Information

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting

Duplicate Advisory: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting

JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages

Duplicate Advisory: SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages

CKAN MCP Server: Information disclosure via verbose error reflection

Withdrawn Advisory: open-webui allows enumeration of file names and traversal of directories by observing the error messages

Apache Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body

Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body

Spring Web Services: SOAP security faults leak Spring Security account state

NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

hashi-vault-js: Vault token and secret values exposed in thrown errors

Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile

Spring Data REST potentially exposes persistence-layer internals to HTTP clients

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

rclone: Verbose Stack Trace Disclosure in RC API Error Responses

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Saleor Unauthenticated Information Disclosure Vulnerability via Python Exceptions

Saleor has Staff-Authenticated Error Message Information Disclosure Vulnerability via Python Exceptions

Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem