By weakness (CWE)

CWE-209: related vulnerabilities

CVEs classified under CWE-209. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

13 published vulnerabilities

• CVE-2026-53906HIGH 8.2

  MCO (MyComplianceOffice) contains a vulnerability in its file handling system that allows attackers to write files to unintended locations on the server and discover sensitive path information through error messages. The flaw stems from inadequate validation of filenames during data export and upload operations. An attacker with network access can exploit this without authentication to alter file placement or gather reconnaissance data about the server's directory structure.

• CVE-2026-47775MEDIUM 6.8

  Envoy, a widely-used open-source proxy for cloud applications, has a weakness in how it protects user authentication data. When processing OAuth2 logins, Envoy encrypts a sensitive code using standard encryption without adding a security tag. An attacker can exploit this by sending many carefully crafted requests to the login callback endpoint, observing whether they succeed or fail, and gradually reconstructing the encrypted code. Once reconstructed, the attacker can impersonate the user if they also have a stolen authorization code. This affects Envoy versions before 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

• CVE-2026-40997MEDIUM 5.3

  Spring Web Services has a flaw where integration with Spring Security can leak information about user account status to unauthenticated SOAP clients. When an attacker attempts to log in via a SOAP endpoint, the system may reveal whether a username exists, is locked, or is disabled—rather than returning a generic "authentication failed" message. This information disclosure helps attackers enumerate valid accounts and understand their lifecycle state without needing valid credentials.

• CVE-2026-41730MEDIUM 5.3

  Spring Data REST, a popular framework for building REST APIs on top of Spring Data repositories, has a flaw where detailed error messages—including information from the underlying database layer—are exposed directly to API clients. When an exception occurs during request processing, the full chain of causes is serialized into HTTP error responses. This means a remote attacker can trigger exceptions and receive detailed stack traces and system internals that should remain hidden. The vulnerability affects multiple versions across the 3.7, 4.3, 4.4, 4.5, and 5.0 release lines.

• CVE-2026-49365MEDIUM 5.3

  Apache Camel's Netty HTTP component has a flaw where error messages are returned to users in plain text, potentially exposing sensitive information like stack traces, credentials, and internal system details. The problem stems from a default setting (muteException=false) that differs from other Camel HTTP components. Any unauthenticated user who can reach the endpoint and trigger an error—such as sending a malformed request—receives the full Java stack trace, which can reveal internal architecture and aid attackers in planning further compromises.

• CVE-2026-56139MEDIUM 5.3

  Apache Camel's Undertow HTTP component has a configuration flaw that causes it to leak sensitive information through error messages. When a client sends a request that triggers an exception, the server returns the full Java stack trace to the requester instead of a generic error response. This happens because the component defaults to exposing exceptions (muteException=false), contrary to other Camel HTTP components. An attacker who can reach an affected endpoint and cause any processing error—such as sending malformed data or invalid parameters—receives detailed internal information including credentials, hostnames, file paths, database names, and application architecture details. The flaw is particularly dangerous in Rest DSL deployments, where the mitigation option is completely ignored even if configured.

• CVE-2026-56331MEDIUM 5.3

  Capgo versions prior to 12.128.2 contain a vulnerability where the invitation acceptance endpoint fails to properly handle invalid input, causing the server to respond with a 500 error instead of a standard client error. This allows attackers to submit malformed invitation codes and observe server errors that may reveal internal system details. The vulnerability requires only the public key to trigger and cannot be exploited for authentication bypass or data modification, but the information leakage could support reconnaissance activities.

• CVE-2026-9794MEDIUM 5.3

  Keycloak contains an information disclosure vulnerability in its SAML ECP (Enhanced Client or Proxy) endpoint. An unauthenticated attacker can send specially crafted SOAP requests with different client IDs to the endpoint and observe the error messages returned. By analyzing these responses, an attacker can infer whether a given client uses SAML or another protocol. While this doesn't grant direct access to sensitive data or systems, it reveals organizational configuration details that could inform further reconnaissance or targeted attacks.

• CVE-2025-36328MEDIUM 4.3

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 leak sensitive information through verbose error messages displayed in web browsers. An attacker with valid credentials can trigger these detailed error responses to extract system details that could facilitate further attacks. This is an information disclosure vulnerability requiring authentication to exploit.

• CVE-2025-52606MEDIUM 4.3

  HCL iControl contains a weakness in how it validates user input during its security architecture implementation. The application fails to properly check that incoming data matches the expected type before processing it, allowing an authenticated attacker to submit malformed input that the system does not adequately verify. This can lead to unintended modifications of application state or data.

• CVE-2025-59872MEDIUM 4.3

  HCL ZIE for Web contains a file upload vulnerability that allows authenticated users to upload files without proper restrictions. If the server is configured to execute code—a common default in web environments—an attacker could upload a malicious script (web shell) to gain remote command execution. The vulnerability requires an authenticated account and depends on server configuration, which limits its immediate risk but makes it a serious concern in environments where these conditions are met.

• CVE-2025-52611LOW 3.1

  HCL iControl v4.0.0 contains a vulnerability where the application crashes and exposes internal error messages, including stack traces, when certain code paths are triggered. The underlying cause is a programming error where the application attempts to access a property (the 'dashboard key') from an object that hasn't been properly initialized or is missing entirely. While an attacker would need valid login credentials to trigger this issue, the exposure of stack trace information could help them understand the application's internal structure and identify further attack vectors.

• CVE-2026-49979LOW 2.7

  Appsmith versions before 1.99 contain a vulnerability in the test email functionality that allows high-privileged users to perform internal network reconnaissance. When an authenticated admin tests the email configuration, the application accepts custom SMTP server addresses without validating whether they point to internal IP ranges. An attacker with admin access can abuse this to probe internal services, discover what's running on specific ports, and gather system information through detailed error messages—all without leaving the admin panel. The vulnerability requires existing admin credentials, limiting its practical attack scope.