CWE-524.

Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure

• Elasticsearch
• CWE-524

Potential exposure of private data via empty and missing Vary headers

• Django
• CWE-524

CachingWebClient shares user-specific HTTP responses across users via the shared cache tier

• Eclipse Foundation Eclipse Vert.x
• Information disclosure
• CWE-524

WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response

• emrevona WP Fastest Cache – WordPress Cache Plugin
• CWE-524

PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache

• wpovernight PDF Invoices & Packing Slips for WooCommerce
• CWE-524

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

• CWE-346
• CWE-524

>=7.0.0, <7.30.1 || >=8.0.0, <8.12.2 · fixed in 7.30.1, 8.12.2

Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache

• Apache Software Foundation Apache Camel
• CWE-524

next.js cache leak across root param values in nested 'use cache' functions

• CWE-524

>=16.3.0, <16.3.8 · fixed in 16.3.8

Use of Cache Containing Sensitive Information in GitLab

• GitLab
• CWE-524

Apache Cocoon: Cross-user cache poisoning

• Apache Software Foundation Apache Cocoon
• CWE-524

Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache

• Apache Software Foundation Apache Camel
• CWE-524

SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check

• softaculous SpeedyCache – Cache, Optimization, Performance
• CWE-524

Contao: Improper access control in the table access voter

• Broken access control
• CWE-524

>=5.7.0, <5.7.12 · fixed in 5.7.12

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

• CWE-524

>=16.3.0, <16.3.8 · fixed in 16.3.8

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

• CWE-524

>=15.0.0, <15.5.27 || >=16.0.0, <16.3.8 · fixed in 15.5.27, 16.3.8

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

• CWE-524

>=15.0.0, <15.5.27 || >=16.0.0, <16.3.8 · fixed in 15.5.27, 16.3.8

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

• Information disclosure
• CWE-524

<0.30.0 · fixed in 0.30.0

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

• Information disclosure
• CWE-524

>=7.0.0, <7.29.1 || >=8.0.0, <8.10.2 · fixed in 7.29.1, 8.10.2

Token Cache Reuse in mcp-toolbox-sdk-python

• Google mcp-toolbox-sdk-python
• CWE-524

Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses

• CWE-524

<=4.2.0 · no fixed version yet

mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches

• CWE-524

>=0.1.0, <0.16.2 · fixed in 0.16.2

Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

• Information disclosure
• CWE-524

<=19.2.25 || >=20.0.0, <20.3.28 || >=21.0.0, <21.2.20 || >=22.0.0, <22.1.1 · fixed in 20.3.28, 21.2.20, 22.1.1

ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

• CWE-524

>=0.1.3, <0.3.1 · fixed in 0.3.1

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

• CWE-349
• CWE-524

<5.0.8 · fixed in 5.0.8

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable

• CWE-524

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

• Other injection
• Information disclosure

<1.2.4 · fixed in 1.2.4

Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

• CWE-524

>=4.2.0.Final, <4.2.17.Final || <4.1.137.Final · fixed in 4.2.17.Final, 4.1.137.Final

Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

• Broken access control
• CWE-524

>=4.4.0, <4.5.1 · fixed in 4.5.1

Potential information leakage from manager /network/graph API in NeuVector

• SUSE NeuVector
• Authentication bypass
• CWE-202

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

• CWE-436
• CWE-524

>=7.0.0, <7.29.0 || >=8.0.0, <8.9.0 · fixed in 7.29.0, 8.9.0

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

• CWE-524

>=0.6.27, <0.10.0 · fixed in 0.10.0

Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension

• regularlabs.com Articles Anywhere extension for Joomla
• regularlabs.com Users Anywhere extension for Joomla
• CWE-524

Next.js: Cache confusion of response bodies for requests with bodies

• CWE-524

>=13.0.0, <15.5.21 || >=16.0.0, <16.2.11 · fixed in 15.5.21, 16.2.11

Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions

• regularlabs.com Articles Anywhere extension for Joomla
• regularlabs.com Conditional Content extension for Joomla
• CWE-524

Directus: Authorization-dependent response served from unsegmented cache key

• Broken access control
• CWE-524

<12.0.0 · fixed in 12.0.0

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

• Broken access control
• CWE-524

>=2.6.0, <4.1.29 || >=4.2.0, <4.2.25 || >=4.3.0, <4.3.8 · fixed in 4.1.29, 4.2.25, 4.3.8

PAN-OS: Information Disclosure Vulnerability in Management Web Interface

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks PAN-OS
• CWE-524

Django: cache middleware may expose private responses when unrelated request cookies are present

• CWE-524

<5.2.16 || >=6.0.0, <6.0.7 · fixed in 5.2.16, 6.0.7

Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

• CWE-524

>=4.0.0, <6.37.0 · fixed in 6.37.0

Information about ECS zero scoped answers might leak to clients that use a specific ECS

• PowerDNS Recursor
• CWE-524

Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure

• Tenable Identity Exposure
• Authentication bypass
• CWE-524

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

• CWE-524

>=7.0.0, <7.28.0 || >=8.0.0, <8.5.0 · fixed in 7.28.0, 8.5.0

@angular/service-worker: Request Credential & Cache Policy Stripping

• Information disclosure
• CWE-524

<=18.2.14 || >=19.0.0-next.0, <19.2.23 || >=20.0.0-next.0, <20.3.22 || >=21.0.0-next.0, <21.2.15 || >=22.0.0-next.0, <22.0.0-rc.2 · fixed in 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2

@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

• CWE-524

<=18.2.14 || >=19.0.0-next.0, <19.2.23 || >=20.0.0-next.0, <20.3.22 || >=21.0.0-next.0, <21.2.15 || >=22.0.0-next.0, <22.0.0-rc.2 · fixed in 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2

Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

• Information disclosure
• CWE-441

<=18.2.14 || >=19.0.0-next.0, <19.2.23 || >=20.0.0-next.0, <20.3.22 || >=21.0.0-next.0, <21.2.15 || >=22.0.0-next.0, <22.0.0-rc.2 · fixed in 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2

Improper Search Cache Isolation for Scoped Search API Keys in Typesense

• typesense
• CWE-524

Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

• CWE-524

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19

drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise

• Linux kernel
• CWE-524

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.

• CWE-524

>=5.2, <5.2.15 || >=6.0, <6.0.6 · fixed in 5.2.15, 6.0.6

Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects

• Joomla! Project Joomla! CMS
• CWE-524

Discourse: Cached outdated summaries can leak removed content

• discourse
• Information disclosure
• CWE-524

Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

• CWE-524

<4.12.18 · fixed in 4.12.18

Django Uses Cache Containing Sensitive Information

• CWE-524

>=5.2, <5.2.14 || >=6.0, <6.0.5 · fixed in 5.2.14, 6.0.5

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.

• CWE-524

>=7.0.0, <7.0.7 || >=6.2.0, <6.2.18 || >=6.1.0, <=6.1.26 || <=5.3.47 · fixed in 7.0.7, 6.2.18

Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters

• Information disclosure
• CWE-436

<3.2.0 · fixed in 3.2.0

Distribution: stale blob access resurrection via repo-scoped redis descriptor cache invalidation

• Broken access control
• CWE-524

<=2.8.3 · no fixed version yet

IBM Planning Analytics Information Disclosure

• IBM Planning Analytics Local
• CWE-524

Flask session does not add `Vary: Cookie` header when accessed in some ways

• CWE-524

<3.1.3 · fixed in 3.1.3

Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)

• mastodon
• CWE-524

Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

• Authentication bypass
• CWE-524

<4.11.7 · fixed in 4.11.7