Weaknesses of type CWE-88

379 results

Divulgação de Informações

Ocorre quando um programa expõe dados sensíveis (credenciais, tokens, caminhos internos, versões de sistemas) a usuários ou processos não autorizados. O risco está na falta de controle sobre quem acessa o quê, permitindo que informações confidenciais sejam lidas ou inferidas por atacantes.

Example

Um servidor web retorna mensagens de erro detalhadas que revelam a estrutura do banco de dados, ou uma API expõe UUIDs internos de usuários em respostas públicas, ou logs de aplicação contêm senhas armazenadas de forma legível em arquivos acessíveis.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC), sanitize mensagens de erro para produção (sem detalhes técnicos), criptografe dados em repouso e em trânsito, revise permissões de arquivos e endpoints, e monitore o que é expostos em respostas HTTP e logs.

CVE-2026-26514HIGHAn Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input wEPSS 0.5%CVE-2026-44449CRITICALLumiverse: SMB `exists()` basename injection via smbclient `!cmd` escapeEPSS 0.5%CVE-2026-75912HIGHCodeWhale before 0.8.64 Argument Injection via git_blameEPSS 0.4%CVE-2024-31966MEDIUMA vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 ConferenEPSS 0.4%CVE-2026-103505MEDIUMAWS EFS CSI Driver Mount Option Injection via mounttargetipmapEPSS 0.4%CVE-2026-22168HIGHOpenClaw < 2026.2.21 - Command Injection via cmd.exe /c Trailing Arguments in system.runEPSS 0.4%CVE-2026-108929CRITICALNetcore NR268 DDNS DDNSset.cgi execvp argument injectionEPSS 0.4%CVE-2026-2298CRITICALImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement alEPSS 0.4%CVE-2026-76212MEDIUMphpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQLEPSS 0.4%CVE-2026-53783HIGHrsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsyncEPSS 0.4%CVE-2026-62968HIGHDream Displays has command-line argument injection in yt-dlp invocationEPSS 0.4%CVE-2026-19482HIGHSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.4%CVE-2026-35538LOWAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injectioEPSS 0.4%CVE-2026-47250MEDIUMmcp-server-kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltrationEPSS 0.4%CVE-2024-7573MEDIUMRelevanssi Live Ajax Search <= 2.4 - Unauthenticated WP_Query Argument InjectionEPSS 0.4%CVE-2026-54085HIGHWazuh: Missing input validation in multiple active response scripts allows argument injectionEPSS 0.4%CVE-2026-78678HIGHGitPython before 3.1.59 Arbitrary File Read via Repo.blame()EPSS 0.4%CVE-2026-87818HIGHGitPython 3.1.59 Local File Content Oracle via --no-indexEPSS 0.4%CVE-2026-109966MEDIUMyt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC MethodEPSS 0.4%CVE-2026-47365CRITICALArgument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass croEPSS 0.4%