agentprime: CWE-524

CVE-2026-115710: Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure

Tue, 03 Nov 2026 16:44:13 GMT

CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-113593: Potential exposure of private data via empty and missing Vary headers

Tue, 03 Nov 2026 15:42:34 GMT

CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-118489: CachingWebClient shares user-specific HTTP responses across users via the shared cache tier

Tue, 03 Nov 2026 14:55:48 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-111464: WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response

Tue, 03 Nov 2026 02:31:19 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-109217: PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache

Sat, 31 Oct 2026 06:44:22 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

Tue, 27 Oct 2026 19:02:31 GMT

undici >=7.0.0, <7.30.1 || >=8.0.0, <8.12.2, fixed in 7.30.1, 8.12.2. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache

Mon, 26 Oct 2026 14:46:11 GMT

CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

next.js cache leak across root param values in nested 'use cache' functions

Thu, 22 Oct 2026 16:08:40 GMT

next >=16.3.0, <16.3.8, fixed in 16.3.8. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-105711: Use of Cache Containing Sensitive Information in GitLab

Wed, 21 Oct 2026 23:34:30 GMT

CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-108088: Apache Cocoon: Cross-user cache poisoning

Tue, 20 Oct 2026 10:25:33 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85317: Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache

Mon, 19 Oct 2026 10:43:39 GMT

CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-104006: SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check

Sat, 10 Oct 2026 06:40:15 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Contao: Improper access control in the table access voter

Fri, 09 Oct 2026 20:53:42 GMT

contao/core-bundle >=5.7.0, <5.7.12, fixed in 5.7.12. CVSS 4.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Wed, 07 Oct 2026 20:32:13 GMT

next >=16.3.0, <16.3.8, fixed in 16.3.8. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Wed, 07 Oct 2026 20:32:06 GMT

next >=15.0.0, <15.5.27 || >=16.0.0, <16.3.8, fixed in 15.5.27, 16.3.8. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

Wed, 07 Oct 2026 20:31:13 GMT

next >=15.0.0, <15.5.27 || >=16.0.0, <16.3.8, fixed in 15.5.27, 16.3.8. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

Tue, 06 Oct 2026 00:02:02 GMT

vllm <0.30.0, fixed in 0.30.0. CVSS 3.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

Tue, 29 Sep 2026 18:19:58 GMT

undici >=7.0.0, <7.29.1 || >=8.0.0, <8.10.2, fixed in 7.29.1, 8.10.2. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-19202: Token Cache Reuse in mcp-toolbox-sdk-python

Tue, 22 Sep 2026 21:48:26 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses

Fri, 18 Sep 2026 18:31:44 GMT

http-cache-semantics <=4.2.0, no fixed version yet. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches

Wed, 16 Sep 2026 08:24:15 GMT

mpp >=0.1.0, <0.16.2, fixed in 0.16.2. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

Thu, 10 Sep 2026 20:19:19 GMT

@angular/common <=19.2.25 || >=20.0.0, <20.3.28 || >=21.0.0, <21.2.20 || >=22.0.0, <22.1.1, fixed in 20.3.28, 21.2.20, 22.1.1. CVSS 4.0 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

Mon, 07 Sep 2026 22:28:24 GMT

ash_authentication_oauth2_server >=0.1.3, <0.3.1, fixed in 0.3.1. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Mon, 24 Aug 2026 20:09:51 GMT

django-cms <5.0.8, fixed in 5.0.8. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-15743: Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable

Thu, 20 Aug 2026 18:15:26 GMT

CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

Wed, 19 Aug 2026 19:22:59 GMT

geolens <1.2.4, fixed in 1.2.4. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

Mon, 17 Aug 2026 18:24:26 GMT

io.netty:netty-codec-http >=4.2.0.Final, <4.2.17.Final || <4.1.137.Final, fixed in 4.2.17.Final, 4.1.137.Final. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

Wed, 05 Aug 2026 21:14:33 GMT

nuxt >=4.4.0, <4.5.1, fixed in 4.5.1. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-25703: Potential information leakage from manager /network/graph API in NeuVector

Wed, 05 Aug 2026 09:48:19 GMT

CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

Mon, 03 Aug 2026 19:32:12 GMT

undici >=7.0.0, <7.29.0 || >=8.0.0, <8.9.0, fixed in 7.29.0, 8.9.0. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Fri, 24 Jul 2026 17:03:21 GMT

open-webui >=0.6.27, <0.10.0, fixed in 0.10.0. CVSS 3.5 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-65755: Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension

Thu, 23 Jul 2026 09:14:11 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

Next.js: Cache confusion of response bodies for requests with bodies

Wed, 22 Jul 2026 23:08:17 GMT

next >=13.0.0, <15.5.21 || >=16.0.0, <16.2.11, fixed in 15.5.21, 16.2.11. CVSS 6.0 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-64792: Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions

Wed, 22 Jul 2026 20:40:58 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

Directus: Authorization-dependent response served from unsegmented cache key

Mon, 20 Jul 2026 21:48:15 GMT

directus <12.0.0, fixed in 12.0.0. CVSS 8.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

Fri, 10 Jul 2026 14:32:01 GMT

api-platform/core >=2.6.0, <4.1.29 || >=4.2.0, <4.2.25 || >=4.3.0, <4.3.8, fixed in 4.1.29, 4.2.25, 4.3.8. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-0281: PAN-OS: Information Disclosure Vulnerability in Management Web Interface

Thu, 09 Jul 2026 19:03:44 GMT

CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Django: cache middleware may expose private responses when unrelated request cookies are present

Tue, 07 Jul 2026 15:32:57 GMT

django <5.2.16 || >=6.0.0, <6.0.7, fixed in 5.2.16, 6.0.7. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

Wed, 01 Jul 2026 21:58:32 GMT

ghost >=4.0.0, <6.37.0, fixed in 6.37.0. CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-40012: Information about ECS zero scoped answers might leak to clients that use a specific ECS

Thu, 25 Jun 2026 12:58:51 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-13007: Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure

Tue, 23 Jun 2026 15:59:50 GMT

CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

Thu, 18 Jun 2026 14:28:13 GMT

undici >=7.0.0, <7.28.0 || >=8.0.0, <8.5.0, fixed in 7.28.0, 8.5.0. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

@angular/service-worker: Request Credential & Cache Policy Stripping

Mon, 15 Jun 2026 17:13:05 GMT

@angular/service-worker <=18.2.14 || >=19.0.0-next.0, <19.2.23 || >=20.0.0-next.0, <20.3.22 || >=21.0.0-next.0, <21.2.15 || >=22.0.0-next.0, <22.0.0-rc.2, fixed in 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2. CVSS 5.7 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

Mon, 15 Jun 2026 16:51:53 GMT

@angular/common <=18.2.14 || >=19.0.0-next.0, <19.2.23 || >=20.0.0-next.0, <20.3.22 || >=21.0.0-next.0, <21.2.15 || >=22.0.0-next.0, <22.0.0-rc.2, fixed in 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

Mon, 15 Jun 2026 16:44:21 GMT

CVE-2026-47225: Improper Search Cache Isolation for Scoped Search API Keys in Typesense

Fri, 12 Jun 2026 17:12:41 GMT

CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

Tue, 09 Jun 2026 06:31:57 GMT

org.springframework:spring-webflux >=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39, fixed in 7.0.8, 6.2.19. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-46309: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise

Mon, 08 Jun 2026 15:50:39 GMT

CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.

Wed, 03 Jun 2026 14:16:41 GMT

django >=5.2, <5.2.15 || >=6.0, <6.0.6, fixed in 5.2.15, 6.0.6. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-48901: Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects

Tue, 26 May 2026 16:42:41 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.