Skip to content
CVE Tracker

CWE-209: Sensitive information in an error message

666 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 3 of them as exploited in the wild.

All 666 in the listAtom feed of new CVEsWhat CWE-209 is, at MITRE (opens in a new tab)
Published CVEs
666
Last 12 months
187
Critical
30
Known exploited
3

Critical 30High 74Medium 463Low 98Not scored 1

CVEs per yearBy the year they were published

  1. 201951
  2. 202061
  3. 202015
  4. 20201
  5. 20217
  6. 20231
  7. 202480
  8. 202474
  9. 202595
  10. 202545
  11. 2026144
  12. 202686

Known exploitedNewest addition to KEV first

  • CVE-2025-47813

    loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

    wftpserver · Wing FTP Server

    ExploitedMedium4.3
  • CVE-2024-29059

    .NET Framework Information Disclosure Vulnerability

    Microsoft · Microsoft .NET Framework 4.8

    ExploitedHigh7.5
  • CVE-2013-7331

    The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share…

    Product not named

    ExploitedMedium6.5

Newest CVEs

  • CVE-2026-120971

    Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses

    Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3

    Medium5.3
  • CVE-2026-105770

    Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages

    octo-sts · app

    Medium5.3
  • CVE-2026-62979

    jack: upstream error responses expose backend and peer credentials

    roziscoding · jack

    High8.4
  • CVE-2026-118643

    n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data

    n8n-io · n8n

    Medium5.3
  • CVE-2026-67080

    HCL BigFix AEX is affected by multiple security vulnerabilities.

    HCL Software · BigFix AEX

    Medium6.5
  • CVE-2026-118272

    a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure

    a2ui-project · a2ui

    Medium5.3
  • CVE-2026-108316

    Tanium addressed an information disclosure vulnerability in Tanium Server.

    Tanium · Tanium Server

    Medium4.3
  • CVE-2026-116479

    a2aproject a2a-java JSON-RPC Error getMessage information exposure

    a2aproject · a2a-java

    Medium5.3
  • CVE-2026-116478

    a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure

    a2aproject · a2a-go

    Medium6.9
  • CVE-2026-116477

    a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure

    a2aproject · a2a-dotnet

    Medium5.3

Vendors it comes up for most

  1. IBM155
  2. Apache Software Foundation19
  3. HCL Software17
  4. Red Hat16
  5. Microsoft13
  6. GitLab10
  7. Dell9
  8. Siemens8
  9. ash-project8
  10. free5gc7