CWE-359 Exposure of Private Personal Information to an Unauthorized Actor

djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerability

Saleor: Customers' addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method

Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

Forwarding of confidentials headers to third parties in fluture-node

@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client

phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration

XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

Ech0 comment model's Email field returned on public /api/comments endpoints

LangSmith SDK: Streaming token events bypass output redaction

Keycloak: Information disclosure of disabled user attributes via administrative endpoint

Apache Answer Exposure of Private Personal Information to an Unauthorized Actor vulnerability

Gitea: anonymous user can visit private user's project

AsyncSSH Rogue Session Attack

Mattermost Server: initial_load API exposes unnecessary information

Withdrawn Advisory: Incorrect Authorization in cross-fetch

Presta Shop vulnerable to email enumeration

XWiki exposes passwords and emails stored in fields not named password/email in xml.vm

XWiki leaks password hashes and other accessible password properties

Weblate exposes personal IP address via e-mail

DynamicPageList3 vulnerability exposes hidden/suppressed usernames

Updatecli exposes Maven credentials in console output

Nautobot vulnerable to exposure of hashed user passwords via REST API