Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.
Volume of CVEs assigned to CWE-540 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
30 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-45728HIGH Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and d | May 26, 2026 | 7.5 | 26 | NO | NO |
CVE-2026-4155HIGH ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive infor | Apr 11, 2026 | 7.5 | 26 | NO | NO |
CVE-2024-38327CRITICAL IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 is vulnerable to information exposure and further attacks due to an exposed JavaScript source map which could assist an attacker to | Jul 10, 2025 | 9.8 | 26 | NO | NO |
CVE-2025-49182CRITICAL Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application. | Jun 12, 2025 | 9.8 | 26 | NO | NO |
CVE-2025-23215CRITICAL PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The privat | Jan 31, 2025 | 9.3 | 25 | NO | NO |
CVE-2026-35383MEDIUM Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain as | Apr 2, 2026 | 6.5 | 22 | NO | NO |
CVE-2025-26013HIGH An issue in Loggrove v.1.0 allows a remote attacker to obtain sensitive information via the read.py component. | Feb 21, 2025 | 8.2 | 22 | NO | NO |
CVE-2024-38647HIGH An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remote attackers to compromise the security | Nov 22, 2024 | 7.5 | 22 | NO | NO |
CVE-2024-8417HIGH A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 1.5.5. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/educ | Sep 4, 2024 | 8.1 | 22 | NO | NO |
CVE-2021-1516MEDIUM A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA), Cisco Email Security Appliance (ESA), and Cis | May 6, 2021 | 6.5 | 22 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.