CWE-20911 advisories

Information Exposure Through an Error Message

What it is

Error messages reveal stack traces, queries or internals that help an attacker.

How to fix it

Upgrade and return generic errors to clients; log details server-side only.

How to avoid it

Never expose stack traces or internal detail to clients; log them internally instead.

Known Information Exposure Through an Error Message vulnerabilities

CVE-2026-73555 — medium · PyPI/vllm
GHSA-ghvf-qf6h-g8x5 — high · npm/@nocobase/server
GHSA-hjwh-xvfw-qrwj — medium · npm/mcp-searxng
GHSA-92hr-gmr6-h8cp — medium · npm/ep_etherpad-lite
CVE-2026-55102 — medium · npm/hashi-vault-js
CVE-2026-69247 — high · PyPI/cryptography
GHSA-ppr4-5f46-j9c6 — high · npm/@budibase/server
CVE-2026-59943 — medium · Packagist/dompdf/dompdf
CVE-2026-54561 — medium · npm/mcp-memory-keeper
GHSA-qcr8-x557-7cp3 — medium · npm/@asymmetric-effort/specifyjs
GHSA-6g9v-7gq3-p2c6 — medium · crates.io/surrealdb

Stateward flags Information Exposure Through an Error Message in your own code and dependencies on every pull request.

Scan my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.