CWE-532
5 CVEs of this weakness class.
Show as table
| Year published | CVEs | In CISA KEV |
|---|---|---|
| 2023 | 2 | 1 |
| 2024 | 0 | 0 |
| 2025 | 2 | 1 |
| 2026 | 1 | 0 |
Exploitation first, with newly exploited CVEs rising above old ones
- CVE-2025-24984MED 4.6KEVEPSS 2%
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
- CVE-2023-21492MED 4.4KEVEPSS 3%
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
- CVE-2023-43261HIGH 7.5Likely realEPSS 59%
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.
- CVE-2026-22778CRIT 9.8EPSS 11%
vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1.
- CVE-2025-9985MED 5.3EPSS 12%
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.