# CWE-525.

Every Advisory and CVE whose sources give the weakness CWE-525, newest first.

## Records, newest first

- [Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242](https://agentprime.io/advisories/CVE-2026-114542.md)
  `CVE-2026-114542` · CVE record: Drupal Simple OAuth (OAuth2) & OpenID Connect · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-525
- [Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245](https://agentprime.io/advisories/CVE-2026-114546.md)
  `CVE-2026-114546` · CVE record: Drupal Media Alias Display · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-525
- [ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247](https://agentprime.io/advisories/CVE-2026-114548.md)
  `CVE-2026-114548` · CVE record: Drupal ImageAPI Optimize WebP · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-525
- [AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270](https://agentprime.io/advisories/CVE-2026-118550.md)
  `CVE-2026-118550` · CVE record: Drupal AI (Artificial Intelligence) · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-525
- [Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292](https://agentprime.io/advisories/CVE-2026-118571.md)
  `CVE-2026-118571` · CVE record: Drupal Media Alias Display · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-525
- [Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138](https://agentprime.io/advisories/CVE-2026-87940.md)
  `CVE-2026-87940` · CVE record: Drupal Key auth · CVSS 5.4 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-525
- [Webform - Less critical - Access bypass - SA-CONTRIB-2026-165](https://agentprime.io/advisories/CVE-2026-96369.md)
  `CVE-2026-96369` · CVE record: Drupal Webform · CVSS 3.1 Low · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-525
- [IBM Concert Software Use of Web Browser Cache Containing Sensitive Information](https://agentprime.io/advisories/CVE-2026-4405.md)
  `CVE-2026-4405` · CVE record: IBM Concert · CVSS 4.0 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-525
- [undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives](https://agentprime.io/advisories/GHSA-4cwx-7wf7-3272.md)
  `GHSA-4cwx-7wf7-3272`, `CVE-2026-13697` · npm `undici`: affected `>=7.0.0, <7.29.0 || >=8.0.0, <8.9.0`, fixed in `7.29.0`, `8.9.0` · CVSS 7.4 High · Not analysed yet · Published 3 Aug 2026 · Tags: Information disclosure, CWE-248, CWE-525
- [HCLSoftware Aftermarket EPC: HCL Aftermarket EPC is vulnerable to attack since the application does not have an…](https://agentprime.io/advisories/CVE-2024-23571.md)
  `CVE-2024-23571` · CVE record: HCLSoftware Aftermarket EPC · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-525
- [nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store](https://agentprime.io/advisories/GHSA-6vgg-xhvh-38ff.md)
  `GHSA-6vgg-xhvh-38ff`, `GO-2026-5191` · Go `github.com/juev/nebula-mesh`: affected `<0.3.2`, fixed in `0.3.2` · CVSS 4.0, no score published · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-525
- [A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V4.0).](https://agentprime.io/advisories/CVE-2026-41918.md)
  `CVE-2026-41918` · CVE record: Siemens RUGGEDCOM RST2428P · CVSS 5.9 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: CWE-525
- [Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed](https://agentprime.io/advisories/GHSA-c57f-mm3j-27q9.md)
  `GHSA-c57f-mm3j-27q9`, `CVE-2026-41322` · npm `@astrojs/node`: affected `<10.0.5`, fixed in `10.0.5` · CVSS 5.3 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: CWE-525
- [Admin Passwords Cached by Browsers in Truesec LAPSWebUI](https://agentprime.io/advisories/CVE-2025-15554.md)
  `CVE-2025-15554` · CVE record: Truesec LAPSWebUI · CVSS 6.0 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-525
- [IBM DevOps Plan REST APIs are vulnerable to exposure of sensitive data through request query parameters.](https://agentprime.io/advisories/CVE-2025-36364.md)
  `CVE-2025-36364` · CVE record: IBM DevOps Plan · CVSS 6.2 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-525
- [Tenda F3 Plaintext Credential Exposure in Configuration Download](https://agentprime.io/advisories/CVE-2026-27514.md)
  `CVE-2026-27514` · CVE record: Shenzhen Tenda Technology Co., Ltd. Tenda F3 · CVSS 7.1 High · Not analysed yet · Published 23 Feb 2026 · Tags: Information disclosure, CWE-525
- [Tenda W30E V2 Missing Cache Controls for Credential-bearing Pages](https://agentprime.io/advisories/CVE-2026-24437.md)
  `CVE-2026-24437` · CVE record: Shenzhen Tenda Technology Co., Ltd. W30E V2 · CVSS 4.8 Medium · Not analysed yet · Published 26 Jan 2026 · Tags: CWE-525
- [HCL AION is affected by a Cacheable HTTP Response vulnerability](https://agentprime.io/advisories/CVE-2025-52659.md)
  `CVE-2025-52659` · CVE record: HCL Software AION · CVSS 2.8 Low · Not analysed yet · Published 19 Jan 2026 · Tags: CWE-525
- [Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels](https://agentprime.io/advisories/GHSA-mhpg-hpj5-73r2.md)
  `GHSA-mhpg-hpj5-73r2`, `BIT-drupal-2025-13083`, `CVE-2025-13083`, `DRUPAL-CORE-2025-008`, `PKSA-d8tb-wwz2-ctxk` · Packagist `drupal/core`: affected `>=7.0, <7.103 || >=8.0.0, <10.4.9 || >=10.5.0, <10.5.6 || >=11.0.0, <11.1.9 || >=11.2.0, <11.2.8`, fixed in `7.103`, `10.4.9`, `10.5.6`, `11.1.9`, `11.2.8` · CVSS 3.7 Low · Not analysed yet · Published 18 Nov 2025 · Tags: CWE-525
- [Liferay Portal and DXP use an incorrect cache-control header](https://agentprime.io/advisories/GHSA-6533-fhr2-f38h.md)
  `GHSA-6533-fhr2-f38h`, `CVE-2025-62276` · Maven `com.liferay:com.liferay.adaptive.media.web` and 1 more: affected `<5.0.52`, fixed in `5.0.52` · CVSS 4.6 Medium · Not analysed yet · Published 1 Nov 2025 · Tags: CWE-525
- [HCL AION is susceptible to Cacheable SSL Page Found vulnerability](https://agentprime.io/advisories/CVE-2025-52625.md)
  `CVE-2025-52625` · CVE record: HCL AION · CVSS 3.7 Low · Not analysed yet · Published 10 Oct 2025 · Tags: CWE-525
- [IBM OpenPages information disclosure](https://agentprime.io/advisories/CVE-2025-36082.md)
  `CVE-2025-36082` · CVE record: IBM OpenPages · CVSS 4.0 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: CWE-525
- [Better Call routing bug can lead to Cache Deception](https://agentprime.io/advisories/GHSA-hq75-xg7r-rx6c.md)
  `GHSA-hq75-xg7r-rx6c` · npm `better-call`: affected `<1.0.12`, fixed in `1.0.12` · CVSS 4.0, no score published · Not analysed yet · Published 11 Jul 2025 · Tags: CWE-525
- [IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure](https://agentprime.io/advisories/CVE-2025-1348.md)
  `CVE-2025-1348` · CVE record: IBM Sterling B2B Integrator · CVSS 4.0 Medium · Not analysed yet · Published 18 Jun 2025 · Tags: CWE-525
- [NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies](https://agentprime.io/advisories/GHSA-f3fg-mf2q-fj3f.md)
  `GHSA-f3fg-mf2q-fj3f`, `CVE-2025-48947` · npm `@auth0/nextjs-auth0`: affected `>=4.0.1, <4.6.1`, fixed in `4.6.1` · CVSS 7.7 High · Not analysed yet · Published 4 Jun 2025 · Tags: CWE-525
- [IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure](https://agentprime.io/advisories/CVE-2025-1334.md)
  `CVE-2025-1334` · CVE record: IBM QRadar Suite Software and 1 more · CVSS 4.0 Medium · Not analysed yet · Published 3 Jun 2025 · Tags: CWE-525
- [Information Exposure vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager](https://agentprime.io/advisories/CVE-2025-27525.md)
  `CVE-2025-27525` · CVE record: Hitachi JP1/IT Desktop Management 2 - Smart Device Manager · CVSS 3.9 Low · Not analysed yet · Published 15 May 2025 · Tags: CWE-525
- [IBM Sterling Control Center information disclosure](https://agentprime.io/advisories/CVE-2023-43035.md)
  `CVE-2023-43035` · CVE record: IBM Sterling Control Center · CVSS 4.0 Medium · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-525
- [IBM Automation Decision Services information disclosure](https://agentprime.io/advisories/CVE-2024-31906.md)
  `CVE-2024-31906` · CVE record: IBM Automation Decision Services · CVSS 6.2 Medium · Not analysed yet · Published 26 Jan 2025 · Tags: CWE-525
- [IBM UrbanCode Velocity information disclosure](https://agentprime.io/advisories/CVE-2024-22349.md)
  `CVE-2024-22349` · CVE record: IBM UrbanCode Velocity and 1 more · CVSS 4.0 Medium · Not analysed yet · Published 20 Jan 2025 · Tags: CWE-525
- [Flask-AppBuilder's login form allows browser to cache sensitive fields](https://agentprime.io/advisories/GHSA-fw5r-6m3x-rh7p.md)
  `GHSA-fw5r-6m3x-rh7p`, `CVE-2024-45314`, `PYSEC-2026-1382` · PyPI `flask-appbuilder`: affected `<4.5.1`, fixed in `4.5.1` · CVSS 3.6 Low · Not analysed yet · Published 4 Sept 2024 · Tags: CWE-525
- [HCL Nomad server on Domino is affected by a use of web browser cache containing sensitive information vulnerability](https://agentprime.io/advisories/CVE-2024-30130.md)
  `CVE-2024-30130` · CVE record: HCL Software Nomad server on Domino · CVSS 3.7 Low · Not analysed yet · Published 19 Jul 2024 · Tags: CWE-525
- [IBM Cloud Pak for Security information disclosure](https://agentprime.io/advisories/CVE-2022-38383.md)
  `CVE-2022-38383` · CVE record: IBM Cloud Pak for Security and 1 more · CVSS 4.0 Medium · Not analysed yet · Published 28 Jun 2024 · Tags: CWE-525
- [Apache Airflow does not return the "Cache-Control" header for dynamic content](https://agentprime.io/advisories/GHSA-9xpj-62mm-24h2.md)
  `GHSA-9xpj-62mm-24h2`, `BIT-airflow-2024-25142`, `CVE-2024-25142`, `PYSEC-2024-195` · PyPI `apache-airflow`: affected `<2.9.2`, fixed in `2.9.2` · CVSS 5.5 Medium · Not analysed yet · Published 14 Jun 2024 · Tags: CWE-525
- [IBM Maximo Application Suite information disclosure](https://agentprime.io/advisories/CVE-2024-22333.md)
  `CVE-2024-22333` · CVE record: IBM Maximo Application Suite and 1 more · CVSS 3.3 Low · Not analysed yet · Published 13 Jun 2024 · Tags: CWE-525
- [IBM Aspera Console information disclosure](https://agentprime.io/advisories/CVE-2022-43841.md)
  `CVE-2022-43841` · CVE record: IBM Aspera Console · CVSS 4.0 Medium · Not analysed yet · Published 30 May 2024 · Tags: CWE-525
- [IBM TXSeries for Multiplatforms information disclosure](https://agentprime.io/advisories/CVE-2024-22343.md)
  `CVE-2024-22343` · CVE record: IBM TXSeries for Multiplatforms · CVSS 4.0 Medium · Not analysed yet · Published 10 May 2024 · Tags: CWE-525
- [IBM Secure Proxy information disclosure](https://agentprime.io/advisories/CVE-2023-46181.md)
  `CVE-2023-46181` · CVE record: IBM Secure Proxy · CVSS 4.0 Medium · Not analysed yet · Published 15 Mar 2024 · Tags: CWE-525
- [IBM Watson CloudPak for Data Data Stores information disclosure](https://agentprime.io/advisories/CVE-2023-27545.md)
  `CVE-2023-27545` · CVE record: IBM Watson CloudPak for Data Data Stores · CVSS 4.0 Medium · Not analysed yet · Published 29 Feb 2024 · Tags: CWE-525
- [IBM Cloud Pak for Business Automation information disclosure](https://agentprime.io/advisories/CVE-2023-23469.md)
  `CVE-2023-23469` · CVE record: IBM Cloud Pak for Business Automation · CVSS 4.0 Medium · Not analysed yet · Published 1 Feb 2023 · Tags: CWE-525
- [Rack-Cache caches sensitive headers](https://agentprime.io/advisories/GHSA-hrp6-w4v2-8737.md)
  `GHSA-hrp6-w4v2-8737`, `CVE-2012-2671` · RubyGems `rack-cache`: affected `>=0.3.0, <1.2`, fixed in `1.2` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: CWE-525
- [Siemens Mendix Applications using Mendix 7: A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions <…](https://agentprime.io/advisories/CVE-2021-42015.md)
  `CVE-2021-42015` · CVE record: Siemens Mendix Applications using Mendix 7 and 2 more · No CVSS score · Not analysed yet · Published 9 Nov 2021 · Tags: CWE-525
- [Cache Manipulation Attack in Apache Traffic Control](https://agentprime.io/advisories/GHSA-pw59-4qgf-jxr8.md)
  `GHSA-pw59-4qgf-jxr8`, `CVE-2020-17522` · Go `github.com/apache/trafficcontrol`: affected `<5.0.0`, fixed in `5.0.0` · CVSS 5.8 Medium · Not analysed yet · Published 18 Jun 2021 · Tags: Broken access control, CWE-525

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-525>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-525/>. Everything for agents: <https://agentprime.io/llms.txt>.