CWE-209 通过错误消息导致的信息暴露 类弱点 395 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-209属于信息泄露漏洞，指软件在生成错误消息时意外包含敏感的环境、用户或数据信息。攻击者通常利用这些详细的错误堆栈或路径信息，识别系统架构、数据库结构或用户身份，从而辅助后续更精准的定向攻击。开发者应避免在生产环境中暴露内部细节，通过配置统一的通用错误页面、过滤敏感字段及记录日志而非直接展示，来防止敏感数据外泄。
try { /.../ } catch (Exception e) { System.out.println(e); }try { openDbConnection(); } //print exception message that includes exception message and configuration file location catch (Exception $e) { echo 'Caught exception: ', $e->getMessage(), '\n'; echo 'Check credentials in config file at: ', $Mysql_config_location, '\n'; }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-118272 | a2ui 信息泄露漏洞 — a2ui | 4.3 | Medium | 2026-10-28 |
| CVE-2026-108316 | Tanium Server 信息泄露漏洞 — Tanium Server | 4.3 | Medium | 2026-10-27 |
| CVE-2026-116479 | a2a-java JSON-RPC 错误信息泄露漏洞 — a2a-java | 4.3 | Medium | 2026-10-26 |
| CVE-2026-116478 | a2aproject a2a-go 信息泄露漏洞 — a2a-go | 5.3 | Medium | 2026-10-26 |
| CVE-2026-116477 | a2aproject a2a-dotnet 信息泄露漏洞 — a2a-dotnet | 4.3 | Medium | 2026-10-26 |
| CVE-2026-101259 | Apache Camel CoAP 组件信息泄露漏洞 — Apache Camel | 5.3 | Medium | 2026-10-26 |
| CVE-2026-115496 | KNIME Business Hub 工作流名称泄露漏洞 — KNIME Business Hub | 6.9 | Medium | 2026-10-22 |
| CVE-2026-114348 | webpack-dev-server 远程信息泄露漏洞 — webpack-dev-server | 5.3 | Medium | 2026-10-22 |
| CVE-2026-113705 | a2aproject a2a-rs 信息泄露漏洞 — a2a-rs | 5.3 | Medium | 2026-10-20 |
| CVE-2026-3628 | IBM Concert 软件信息泄露漏洞 — Concert | 5.3 | Medium | 2026-10-19 |
| CVE-2026-85315 | Apache Camel gRPC 组件未屏蔽异常信息泄露漏洞 — Apache Camel | 5.3 | Medium | 2026-10-19 |
| CVE-2026-85257 | Apache Camel 信息泄露漏洞 — Apache Camel | 5.3 | Medium | 2026-10-19 |
| CVE-2026-85246 | Apache Camel 信息泄露漏洞 — Apache Camel | 5.3 | Medium | 2026-10-19 |
| CVE-2026-84180 | Apache Camel 信息泄露漏洞 — Apache Camel | 5.3 | Medium | 2026-10-19 |
| CVE-2026-110889 | WordPress Gantry 5 5.6.4 敏感数据泄露漏洞 — Gantry 5 Framework | 7.5 | High | 2026-10-17 |
| CVE-2026-91882 | Dell Terraform Provider OME敏感信息注入漏洞 — Terraform Provider for OME | 8.6 | High | 2026-10-14 |
| CVE-2026-86607 | Hitachi Ops Center Administrator 内部应用信息泄露漏洞 — Hitachi Ops Center Administrator | 4.3 | Medium | 2026-10-14 |
| CVE-2026-14909 | IBM WebSphere Application Server Liberty 信息泄露漏洞 — WebSphere Application Server - Liberty | 6.5 | Medium | 2026-10-13 |
| CVE-2026-83786 | Windows NTFS 信息泄露漏洞 — Windows 10 Version 1607 | 4.7 | Medium | 2026-10-13 |
| CVE-2026-85115 | .NET Client Library for SIMATIC S7 多个版本密码泄露漏洞 — .NET Client Library for SIMATIC S7 Webserver API | 5.5 | Medium | 2026-10-13 |
| CVE-2026-105283 | AshTypescript RPC内部错误术语泄露漏洞 — ash_typescript | 6.3 | Medium | 2026-10-12 |
| CVE-2026-75597 | pyLoad web目录未授权访问绕过认证 — pyload | 5.3 | Medium | 2026-10-09 |
| CVE-2026-78021 | Dell Secure Connect Gateway <5.34.00.16 敏感信息泄露漏洞 — Secure Connect Gateway (SCG) Policy Manager | 3.7 | Low | 2026-10-09 |
| CVE-2026-105828 | Parse Server 9.10.1-alpha.12前类名通过GraphQL错误披露漏洞 — parse-server | 6.3 | Medium | 2026-10-08 |
| CVE-2026-101029 | Gitea 迁移及拉取镜像SSRF漏洞 — Gitea | - | - | 2026-10-06 |
| CVE-2026-106123 | RabbitMQ Java 客户端 ConnectionFactoryConfigurator.load() 凭据泄露漏洞 — rabbitmq-java-client | 5.7 | Medium | 2026-10-06 |
| CVE-2026-105707 | uptrace user_handler.go 登录信息泄露漏洞 — uptrace | 5.3 | Medium | 2026-10-06 |
| CVE-2026-66248 | HCL iControl 错误处理不当漏洞 — iControl | 3.1 | Low | 2026-10-01 |
| CVE-2026-100677 | stoatchat 0.15.5 账号枚举漏洞 — stoatchat | 5.3 | Medium | 2026-09-26 |
| CVE-2026-4638 | Paessler PRTG 明文密码泄露漏洞 — PRTG Network Monitor | 7.1 | High | 2026-09-24 |
CWE-209（通过错误消息导致的信息暴露） 是常见的弱点类别，本平台收录该类弱点关联的 395 条 CVE 漏洞。