# CWE-524.

Every Advisory and CVE whose sources give the weakness CWE-524, newest first.

## Records, newest first (an older page)

- [Umbraco.Forms CDN may cache sensitive form uploads when processed by ImageSharp](https://agentprime.io/advisories/GHSA-7jxj-rpx7-ph2c.md)
  `GHSA-7jxj-rpx7-ph2c` · NuGet `Umbraco.Forms`: affected `<13.9.0 || >=14.0.0-beta001, <16.4.0 || >=17.0.0-rc1, <17.1.0`, fixed in `13.9.0`, `16.4.0`, `17.1.0` · CVSS 3.1 Low · Not analysed yet · Published 22 Jan 2026 · Tags: CWE-524
- [An issue was discovered in Chamillo LMS 1.11.2.](https://agentprime.io/advisories/CVE-2025-69581.md)
  `CVE-2025-69581` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: CWE-524
- [axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header](https://agentprime.io/advisories/GHSA-x4m5-4cw8-vc44.md)
  `GHSA-x4m5-4cw8-vc44`, `CVE-2025-69202` · npm `axios-cache-interceptor`: affected `<1.11.1`, fixed in `1.11.1` · CVSS 6.0 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Broken access control, CWE-524, CWE-573
- [The issue was addressed with improved handling of caches.](https://agentprime.io/advisories/CVE-2025-43410.md)
  `CVE-2025-43410` · CVE record: Apple macOS · CVSS 2.4 Low · Not analysed yet · Published 12 Dec 2025 · Tags: CWE-524
- [Brother Industries, Ltd. Android App "Brother iPrint&Scan": Android App "Brother iPrint&Scan" versions 6.13.7 and earlier improperly uses an external…](https://agentprime.io/advisories/CVE-2025-64696.md)
  `CVE-2025-64696` · CVE record: Brother Industries, Ltd. Android App "Brother iPrint&Scan" · CVSS 4.8 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-524
- [An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-co...](https://agentprime.io/advisories/GHSA-gq25-78jf-v78c.md)
  `GHSA-gq25-78jf-v78c`, `CVE-2025-65681`, `PYSEC-2025-219` · PyPI `tutor`: affected `<=20.0.2`, no fixed version yet · CVSS 3.3 Low · Not analysed yet · Published 26 Nov 2025 · Tags: Authentication bypass, CWE-524
- [authkit-nextjs may let session cookies be cached in CDNs](https://agentprime.io/advisories/GHSA-p8pf-44ff-93gf.md)
  `GHSA-p8pf-44ff-93gf`, `CVE-2025-64762` · npm `@workos-inc/authkit-nextjs`: affected `<2.11.1`, fixed in `2.11.1` · CVSS 8.0 High · Not analysed yet · Published 20 Nov 2025 · Tags: CWE-524
- [Discourse is missing Cache-Control response header on error responses](https://agentprime.io/advisories/CVE-2025-61598.md)
  `CVE-2025-61598` · CVE record: discourse discourse · CVSS 6.3 Medium · Not analysed yet · Published 28 Oct 2025 · Tags: CWE-524
- [Libsoup: improper handling of http vary header in libsoup caching](https://agentprime.io/advisories/CVE-2025-9901.md)
  `CVE-2025-9901` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: CWE-524
- [Next.js Affected by Cache Key Confusion for Image Optimization API Routes](https://agentprime.io/advisories/GHSA-g5qg-72qw-gw5v.md)
  `GHSA-g5qg-72qw-gw5v`, `CVE-2025-57752` · npm `next`: affected `>=0.9.9, <14.2.31 || >=15.0.0, <15.4.5`, fixed in `14.2.31`, `15.4.5` · CVSS 6.2 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: CWE-524
- [Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache](https://agentprime.io/advisories/CVE-2025-5141.md)
  `CVE-2025-5141` · CVE record: Fortra Core Privileged Access Manager (BoKS) · CVSS 5.5 Medium · Not analysed yet · Published 17 Jun 2025 · Tags: CWE-524
- [Prisma Access Browser: Inappropriate implementation in Cache](https://agentprime.io/advisories/CVE-2025-4233.md)
  `CVE-2025-4233` · CVE record: Palo Alto Networks Prisma Access Browser · CVSS 5.1 Medium · Not analysed yet · Published 12 Jun 2025 · Tags: CWE-524
- [HCL Domino Volt and Domino Leap are affected by missing "no cache" headers](https://agentprime.io/advisories/CVE-2023-37517.md)
  `CVE-2023-37517` · CVE record: HCL Software HCL Domino Leap · CVSS 3.2 Low · Not analysed yet · Published 30 Apr 2025 · Tags: CWE-524
- [HCL Leap is affected by missing "no cache" headers](https://agentprime.io/advisories/CVE-2023-37516.md)
  `CVE-2023-37516` · CVE record: HCL Software HCL Leap · CVSS 3.2 Low · Not analysed yet · Published 24 Apr 2025 · Tags: CWE-524
- [HCL Leap is affected by missing "no cache" headers](https://agentprime.io/advisories/CVE-2024-30127.md)
  `CVE-2024-30127` · CVE record: HCL Software HCL Leap · CVSS 3.2 Low · Not analysed yet · Published 24 Apr 2025 · Tags: CWE-524
- [Rapid Cache <= 1.2.3 - Unauthenticated Cache Poisoning](https://agentprime.io/advisories/CVE-2024-12314.md)
  `CVE-2024-12314` · CVE record: megaoptim Rapid Cache · CVSS 7.2 High · Not analysed yet · Published 18 Feb 2025 · Tags: CWE-524
- [JetBrains Ktor information disclosure](https://agentprime.io/advisories/GHSA-8qv4-773j-c979.md)
  `GHSA-8qv4-773j-c979`, `CVE-2024-49580` · Maven `io.ktor:ktor-client-core-jvm`: affected `<2.3.13`, fixed in `2.3.13` · CVSS 5.3 Medium · Not analysed yet · Published 17 Oct 2024 · Tags: CWE-524
- [Session is cached for OpenID and OAuth2 if \`redirect\` is not used](https://agentprime.io/advisories/GHSA-cff8-x7jv-4fm8.md)
  `GHSA-cff8-x7jv-4fm8`, `CVE-2024-45596` · npm `directus` and 1 more: affected `<10.13.3 || >=11.0.0-rc.1, <11.1.0`, fixed in `10.13.3`, `11.1.0` · CVSS 7.4 High · Not analysed yet · Published 10 Sept 2024 · Tags: Authentication bypass, CWE-524
- [Siemens SINEC Traffic Analyzer: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All…](https://agentprime.io/advisories/CVE-2024-41906.md)
  `CVE-2024-41906` · CVE record: Siemens SINEC Traffic Analyzer · CVSS 6.3 Medium · Not analysed yet · Published 13 Aug 2024 · Tags: CWE-524
- [Insecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices)](https://agentprime.io/advisories/CVE-2024-33004.md)
  `CVE-2024-33004` · CVE record: SAP_SE SAP BusinessObjects Business Intelligence Platform (Webservices) · CVSS 4.3 Medium · Not analysed yet · Published 14 May 2024 · Tags: Information disclosure, CWE-524
- [CoreDNS may return invalid cache entries](https://agentprime.io/advisories/GHSA-m9w6-wp3h-vq8g.md)
  `GHSA-m9w6-wp3h-vq8g`, `CVE-2024-0874`, `GO-2024-2785` · Go `github.com/coredns/coredns`: affected `<1.11.2`, fixed in `1.11.2` · CVSS 5.3 Medium · Not analysed yet · Published 25 Apr 2024 · Tags: CWE-524
- [Shopware's session is persistent in Cache for 404 pages](https://agentprime.io/advisories/GHSA-c2f9-4jmm-v45m.md)
  `GHSA-c2f9-4jmm-v45m`, `CVE-2024-27917`, `PKSA-5pbs-7q37-td9b`, `PKSA-hh61-vznp-4z86` · Packagist `shopware/platform` and 1 more: affected `>=6.5.8.0, <6.5.8.7`, fixed in `6.5.8.7` · CVSS 7.5 High · Not analysed yet · Published 6 Mar 2024 · Tags: CWE-524
- [HCL Sametime is impacted by an autocomplete enabled vulnerability](https://agentprime.io/advisories/CVE-2023-45696.md)
  `CVE-2023-45696` · CVE record: HCL Software HCL Sametime · CVSS 4.0 Medium · Not analysed yet · Published 10 Feb 2024 · Tags: CWE-524
- [Information Disclosure vulnerability in SAP Commerce (OCC API)](https://agentprime.io/advisories/CVE-2023-37486.md)
  `CVE-2023-37486` · CVE record: SAP_SE SAP Commerce (OCC API) · CVSS 5.9 Medium · Not analysed yet · Published 8 Aug 2023 · Tags: CWE-524
- [An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.](https://agentprime.io/advisories/CVE-2021-44854.md)
  `CVE-2021-44854` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 26 Dec 2022 · Tags: CWE-524
- [Batched HTTP requests may set incorrect \`cache-control\` response header](https://agentprime.io/advisories/GHSA-8r69-3cvp-wxc3.md)
  `GHSA-8r69-3cvp-wxc3` · npm `@apollo/server` and 1 more: affected `<4.1.0`, fixed in `4.1.0` · No CVSS score · Not analysed yet · Published 2 Nov 2022 · Tags: CWE-524
- [The issue was addressed with improved handling of caches.](https://agentprime.io/advisories/CVE-2022-32909.md)
  `CVE-2022-32909` · CVE record: Apple iOS · CVSS 5.5 Medium · Not analysed yet · Published 1 Nov 2022 · Tags: CWE-524
- [Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.](https://agentprime.io/advisories/GHSA-7fqm-jm52-f9vc.md)
  `GHSA-7fqm-jm52-f9vc`, `CVE-2022-3292`, `PYSEC-2022-296` · PyPI `rdiffweb`: affected `<2.4.8`, fixed in `2.4.8` · CVSS 4.3 Medium · Not analysed yet · Published 28 Sept 2022 · Tags: CWE-524
- [Kubernetes Unsafe Cacheing](https://agentprime.io/advisories/GHSA-2575-pghm-6qqx.md)
  `GHSA-2575-pghm-6qqx`, `CVE-2019-11244` · Go `k8s.io/client-go`: affected `>=1.8.0, <1.12.9`, fixed in `1.12.9` · CVSS 3.3 Low · Not analysed yet · Published 15 Feb 2022 · Tags: Broken access control, CWE-524
- [Facebook WhatsApp Business for Android: A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp…](https://agentprime.io/advisories/CVE-2021-24027.md)
  `CVE-2021-24027` · CVE record: Facebook WhatsApp Business for Android and 1 more · No CVSS score · Not analysed yet · Published 6 Apr 2021 · Tags: CWE-524
- [Atlassian Jira: The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers…](https://agentprime.io/advisories/CVE-2019-14997.md)
  `CVE-2019-14997` · CVE record: Atlassian Jira · No CVSS score · Not analysed yet · Published 11 Sept 2019 · Tags: CWE-524
- [The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns](https://agentprime.io/advisories/CVE-2019-9495.md)
  `CVE-2019-9495` · CVE record: Wi-Fi Alliance hostapd with EAP-pwd support and 1 more · No CVSS score · Not analysed yet · Published 17 Apr 2019 · Tags: CWE-524
- [The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side-channel attacks](https://agentprime.io/advisories/CVE-2019-9494.md)
  `CVE-2019-9494` · CVE record: Wi-Fi Alliance hostapd with SAE support and 1 more · No CVSS score · Not analysed yet · Published 17 Apr 2019 · Tags: CWE-208, CWE-524

Newest: <https://agentprime.io/advisories/tag/cwe-524.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-524&cursor=WyIyMDI2LTAxLTI3VDE5OjA0OjE3LjAwMDAwMFoiLCJHSFNBLTZ3cXctMnA5dy00dnc0Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-524/?cursor=WyIyMDI2LTAxLTI3VDE5OjA0OjE3LjAwMDAwMFoiLCJHSFNBLTZ3cXctMnA5dy00dnc0Il0>. Everything for agents: <https://agentprime.io/llms.txt>.