Weaknesses of type CWE-88

380 results

Divulgação de Informações

Ocorre quando um programa expõe dados sensíveis (credenciais, tokens, caminhos internos, versões de sistemas) a usuários ou processos não autorizados. O risco está na falta de controle sobre quem acessa o quê, permitindo que informações confidenciais sejam lidas ou inferidas por atacantes.

Example

Um servidor web retorna mensagens de erro detalhadas que revelam a estrutura do banco de dados, ou uma API expõe UUIDs internos de usuários em respostas públicas, ou logs de aplicação contêm senhas armazenadas de forma legível em arquivos acessíveis.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC), sanitize mensagens de erro para produção (sem detalhes técnicos), criptografe dados em repouso e em trânsito, revise permissões de arquivos e endpoints, e monitore o que é expostos em respostas HTTP e logs.

CVE-2026-39884HIGHMCP Server Kubernetes has Argument Injection in its port_forward tool via space-splittingEPSS 0.3%CVE-2026-111728MEDIUMSeanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettingsEPSS 0.3%CVE-2022-20930MEDIUMCisco SD-WAN Software Arbitrary File Corruption VulnerabilityEPSS 0.3%CVE-2026-100561HIGHOpenClaw before 2026.8.1 Authentication Bypass via Exec WrapperEPSS 0.2%CVE-2026-7725MEDIUMPrefectHQ prefect GitRepository Pull storage.py argument injectionEPSS 0.2%CVE-2026-94588MEDIUMIn Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper EPSS 0.2%CVE-2026-116252HIGHpgAdmin 4: Materialized view refresh redirects its connection through a crafted database nameEPSS 0.2%CVE-2026-8773MEDIUMlinlinjava litemall Database Setting DbUtil.java load argument injectionEPSS 0.2%CVE-2026-23924MEDIUMAgent 2 Docker plugin arbitrary file read via Docker API injectionEPSS 0.2%CVE-2026-25690MEDIUMAn improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through EPSS 0.2%CVE-2026-41013HIGHTenant-controlled comma smuggles arbitrary CIFS mount optionsEPSS 0.2%CVE-2026-48711HIGHSSHFS: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')EPSS 0.2%CVE-2026-40113HIGHPraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-varsEPSS 0.2%CVE-2026-68766HIGHhashcat through 7.1.2 Arbitrary File Write via Restore File Option InjectionEPSS 0.2%CVE-2026-89066HIGHOS command injection in the task synthesis component in projenEPSS 0.2%CVE-2026-24739MEDIUMSymfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operationsEPSS 0.2%CVE-2026-11332HIGHAnsible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionEPSS 0.2%CVE-2026-55887HIGHMCP Gateway: Argument injection via OCI image label YAML in Docker MCP GatewayEPSS 0.2%CVE-2026-43698HIGHAn injection issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 1EPSS 0.2%CVE-2026-12171HIGHauto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRFEPSS 0.2%