CVE-2026-15743 | Medium | 5.7 | 2026-08-20 | Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable.
The _serve_static method always sets the Cache-Control h… |
CVE-2026-54625 | Medium | 4.8 | 2026-08-20 | django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request head… |
CVE-2026-59903 | Medium | 6.5 | 2026-08-17 | Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler set… |
CVE-2026-71316 | High | 7.5 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be return… |
CVE-2026-25703 | High | 7.3 | 2026-08-05 | NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive… |
CVE-2026-14643 | Medium | 5.9 | 2026-07-29 | undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici f… |
CVE-2026-64648 | Medium | 5.4 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with… |
CVE-2026-65755 | High | 7.5 | 2026-07-23 | Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did… |
CVE-2026-64792 | High | 7.5 | 2026-07-22 | Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render… |
CVE-2026-61836 | High | 8.6 | 2026-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in… |
CVE-2026-0281 | High | 7.1 | 2026-07-09 | An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web in… |
CVE-2026-59213 | Low | 3.5 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all_models handlers in routers/openai.py a… |
CVE-2026-48588 | Low | 3.1 | 2026-07-07 | An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
`UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on… |
CVE-2026-49858 | Medium | 5.9 | 2026-07-01 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheK… |
CVE-2026-40012 | Medium | 5.3 | 2026-06-25 | ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled; |
CVE-2026-53943 | Critical | 9.6 | 2026-06-24 | Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared betwe… |
CVE-2026-13007 | High | 7.5 | 2026-06-23 | Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including clearte… |
CVE-2026-50184 | Medium | 6.1 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2… |
CVE-2026-50170 | High | 7.5 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2… |
CVE-2026-50169 | Medium | 6.1 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2… |
CVE-2026-9678 | Medium | 5.9 | 2026-06-17 | Impact:
Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified p… |
CVE-2026-47225 | | | 2026-06-12 | Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is a cache isolation issue affecting search requests that use both ser… |
CVE-2026-41841 | Medium | 5.9 | 2026-06-09 | Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.
Affected versions:
Spring Framework 7.0… |
CVE-2026-46309 | High | 7.0 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved:
drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise
Add validation in… |
CVE-2026-35193 | Low | 3.1 | 2026-06-03 | An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
`django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization… |
CVE-2026-48901 | High | 7.5 | 2026-05-26 | The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key. |
CVE-2026-32244 | Medium | 5.3 | 2026-05-19 | Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, outdated cached AI summaries can leak… |
CVE-2026-44457 | Medium | 5.3 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses th… |
CVE-2026-6907 | Medium | 4.3 | 2026-05-05 | An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.
`django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary`… |
CVE-2026-22741 | Low | 3.1 | 2026-04-29 | Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.
More precisely, an application can be vulnerable when… |
CVE-2026-35172 | High | 7.5 | 2026-04-06 | Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit… |
CVE-2025-14806 | Medium | 5.7 | 2026-03-17 | IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific resp… |
CVE-2026-27205 | Medium | 4.3 | 2026-02-21 | Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set th… |
CVE-2026-25540 | Medium | 6.5 | 2026-02-04 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web cache poison… |
CVE-2026-24472 | Medium | 5.3 | 2026-01-27 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclos… |
CVE-2025-69581 | Medium | 5.5 | 2026-01-16 | An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even after logout because pr… |
CVE-2025-69202 | Medium | 6.5 | 2025-12-29 | Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream service using different auth tokens, axios-c… |
CVE-2025-43410 | Low | 2.4 | 2025-12-12 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.2. An attacker with… |
CVE-2025-64696 | Low | 3.3 | 2025-12-09 | Android App "Brother iPrint&Scan" versions 6.13.7 and earlier improperly uses an external cache directory. If exploited, application-specific files may be acce… |
CVE-2025-65681 | Low | 3.3 | 2025-11-26 | An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information… |
CVE-2025-64762 | Critical | 9.1 | 2025-11-21 | The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs ve… |
CVE-2025-61598 | Medium | 5.3 | 2025-10-28 | Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was… |
CVE-2025-9901 | Medium | 5.9 | 2025-09-03 | A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that re… |
CVE-2025-57752 | Medium | 6.2 | 2025-08-29 | Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization… |
CVE-2025-5141 | Medium | 5.5 | 2025-06-17 | A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1… |
CVE-2025-4233 | | | 2025-06-12 | An insufficient implementation of cache vulnerability in Palo Alto Networks Prisma® Access Browser enables users to bypass certain data control policies. |
CVE-2023-37517 | Low | 3.2 | 2025-04-30 | Missing "no cache" headers in HCL Leap permits sensitive data to be cached. |
CVE-2024-30127 | Low | 3.2 | 2025-04-24 | Missing "no cache" headers in HCL Leap permits sensitive data to be cached. |
CVE-2023-37516 | Low | 3.2 | 2025-04-24 | Missing "no cache" headers in HCL Leap permits user directory information to be cached. |
CVE-2024-12314 | High | 7.2 | 2025-02-18 | The Rapid Cache plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 1.2.3. This is due to plugin storing HTTP headers i… |
CVE-2024-49580 | Medium | 5.3 | 2024-10-17 | In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure |
CVE-2024-45596 | High | 7.4 | 2024-09-10 | Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via… |
CVE-2024-41906 | Medium | 4.8 | 2024-08-13 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application does not properly handle cac… |
CVE-2024-33004 | Medium | 4.3 | 2024-05-14 | SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On succes… |
CVE-2024-0874 | Medium | 5.3 | 2024-04-25 | A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching. |
CVE-2024-27917 | High | 7.5 | 2024-03-06 | Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. S… |
CVE-2023-45696 | Medium | 4.0 | 2024-02-10 | Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the… |
CVE-2023-37486 | Medium | 5.9 | 2023-08-08 | Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which wo… |
CVE-2021-44854 | Medium | 5.3 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis. |
CVE-2022-32909 | Medium | 5.5 | 2022-11-01 | The issue was addressed with improved handling of caches. This issue is fixed in iOS 16. An app may be able to access user-sensitive data. |
CVE-2022-3292 | Medium | 4.6 | 2022-09-28 | Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8. |
CVE-2021-24027 | High | 7.5 | 2021-04-06 | A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to… |
CVE-2019-14997 | Medium | 4.3 | 2019-09-11 | The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an i… |
CVE-2019-11244 | Medium | 5.0 | 2019-04-22 | In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with wo… |
CVE-2019-9495 | Low | 3.7 | 2019-04-17 | The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hosta… |
CVE-2019-9494 | Medium | 5.9 | 2019-04-17 | The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access p… |