CWE-201Insertion of Sensitive Information Into Sent Data

Abstraction: Base · CVEs in our corpus: 412

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Last updated: 26 September 2026 07:22 UTC

OWASP Top 10 for Web (2025)

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

Detect

Catch it (CSF Detect / Respond)

Harden

Shrink the surface (DISA STIG)

Validate

Prove the fix (OWASP ASVS)

Control	Title	Family	Why it addresses this CWE
`SI-20`	Tainting	SI	Embedding taints allows detection when sensitive data is inserted into outbound or sent data streams.

CVE	Risk	CVSS	EPSS	Published
`CVE-2018-17245`	7.6	9.8	0.0152	2018-12-20
`CVE-2020-26085`	7.4	9.9	0.0224	2021-01-07
`CVE-2025-49408`	7.4	10.0	0.0049	2025-08-20
`CVE-2020-27134`	7.3	9.9	0.0167	2020-12-11
`CVE-2020-27127`	7.2	9.9	0.0135	2020-12-11
`CVE-2020-27132`	7.2	9.9	0.0145	2020-12-11
`CVE-2020-27133`	7.2	9.9	0.0114	2020-12-11
`CVE-2026-39912`	7.0	9.1	0.0070	2026-04-09
`CVE-2026-42880`	6.9	9.6	0.0056	2026-05-07
`CVE-2026-8924`	6.9	9.1	0.0066	2026-07-03
`CVE-2025-41118`	6.8	9.1	0.0041	2026-04-15
`CVE-2025-58098`	6.6	8.3	0.0142	2025-12-05
`CVE-2023-48240`	6.5	9.0	0.0071	2023-11-20
`CVE-2025-48749`	6.4	9.1	0.0043	2025-05-28
`CVE-2025-60188`	6.4	7.5	0.0348	2025-11-06
`CVE-2026-46481`	6.3	8.3	0.0042	2026-06-08
`CVE-2026-67425`	6.3	8.6	0.0056	2026-07-29
`CVE-2026-82209`	6.3	8.2	0.0052	2026-09-06
`CVE-2016-10518`	6.2	7.5	0.0202	2018-05-31
`CVE-2016-10519`	6.2	7.5	0.0164	2018-05-31
`CVE-2021-26566`	6.2	8.3	0.0151	2021-02-26
`CVE-2024-32825`	6.2	7.5	0.0202	2024-04-24
`CVE-2025-3529`	6.2	8.2	0.0040	2025-04-23
`CVE-2026-24477`	6.2	7.5	0.0171	2026-01-27
`CVE-2020-8975`	6.1	7.5	0.0113	2022-10-17