The product generates an error message that includes sensitive information about its environment, users, or associated data.
Volume of CVEs assigned to CWE-209 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
574 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-29059HIGH .NET Framework Information Disclosure Vulnerability | Mar 23, 2024 | 7.5 | 97 | YES | YES |
CVE-2013-7331MEDIUM The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostn | Feb 26, 2014 | 6.5 | 90 | YES | YES |
CVE-2025-47813MEDIUM loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie. | Jul 10, 2025 | 4.3 | 89 | YES | YES |
CVE-2021-22145MEDIUM A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submi | Jul 21, 2021 | 6.5 | 86 | NO | YES |
CVE-2025-62168HIGH Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulne | Oct 17, 2025 | 7.5 | 76 | NO | YES |
CVE-2010-3332MEDIUM Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes | Sep 22, 2010 | 6.4 | 69 | NO | YES |
CVE-2026-22778CRITICAL vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an er | Feb 2, 2026 | 9.8 | 53 | NO | YES |
CVE-2018-17961HIGH Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incom | Oct 15, 2018 | 8.6 | 43 | NO | YES |
CVE-2024-45440MEDIUM core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist. | Aug 29, 2024 | 5.3 | 39 | NO | YES |
CVE-2022-0660HIGH Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11. | Feb 18, 2022 | 7.5 | 38 | NO | YES |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.