CWE-525.

Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242

• Drupal Simple OAuth (OAuth2) & OpenID Connect
• CWE-525

Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245

• Drupal Media Alias Display
• CWE-525

ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247

• Drupal ImageAPI Optimize WebP
• CWE-525

AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270

• Drupal AI (Artificial Intelligence)
• CWE-525

Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292

• Drupal Media Alias Display
• CWE-525

Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

• Drupal Key auth
• CWE-525

Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

• Drupal Webform
• CWE-525

IBM Concert Software Use of Web Browser Cache Containing Sensitive Information

• IBM Concert
• CWE-525

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

• Information disclosure
• CWE-248

>=7.0.0, <7.29.0 || >=8.0.0, <8.9.0 · fixed in 7.29.0, 8.9.0

HCLSoftware Aftermarket EPC: HCL Aftermarket EPC is vulnerable to attack since the application does not have an…

• HCLSoftware Aftermarket EPC
• CWE-525

nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store

• CWE-525

<0.3.2 · fixed in 0.3.2

A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V4.0).

• Siemens RUGGEDCOM RST2428P
• CWE-525

Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed

• CWE-525

<10.0.5 · fixed in 10.0.5

Admin Passwords Cached by Browsers in Truesec LAPSWebUI

• Truesec LAPSWebUI
• CWE-525

IBM DevOps Plan REST APIs are vulnerable to exposure of sensitive data through request query parameters.

• IBM DevOps Plan
• CWE-525

Tenda F3 Plaintext Credential Exposure in Configuration Download

• Shenzhen Tenda Technology Co., Ltd. Tenda F3
• Information disclosure
• CWE-525

Tenda W30E V2 Missing Cache Controls for Credential-bearing Pages

• Shenzhen Tenda Technology Co., Ltd. W30E V2
• CWE-525

HCL AION is affected by a Cacheable HTTP Response vulnerability

• HCL Software AION
• CWE-525

Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels

• CWE-525

>=7.0, <7.103 || >=8.0.0, <10.4.9 || >=10.5.0, <10.5.6 || >=11.0.0, <11.1.9 || >=11.2.0, <11.2.8 · fixed in 7.103, 10.4.9, 10.5.6, 11.1.9, 11.2.8

Liferay Portal and DXP use an incorrect cache-control header

• CWE-525

<5.0.52 · fixed in 5.0.52

HCL AION is susceptible to Cacheable SSL Page Found vulnerability

• HCL AION
• CWE-525

IBM OpenPages information disclosure

• IBM OpenPages
• CWE-525

Better Call routing bug can lead to Cache Deception

• CWE-525

<1.0.12 · fixed in 1.0.12

IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure

• IBM Sterling B2B Integrator
• CWE-525

NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

• CWE-525

>=4.0.1, <4.6.1 · fixed in 4.6.1

IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure

• IBM QRadar Suite Software
• IBM Cloud Pak for Security
• CWE-525

Information Exposure vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager

• Hitachi JP1/IT Desktop Management 2 - Smart Device Manager
• CWE-525

IBM Sterling Control Center information disclosure

• IBM Sterling Control Center
• CWE-525

IBM Automation Decision Services information disclosure

• IBM Automation Decision Services
• CWE-525

IBM UrbanCode Velocity information disclosure

• IBM UrbanCode Velocity
• IBM DevOps Velocity
• CWE-525

Flask-AppBuilder's login form allows browser to cache sensitive fields

• CWE-525

<4.5.1 · fixed in 4.5.1

HCL Nomad server on Domino is affected by a use of web browser cache containing sensitive information vulnerability

• HCL Software Nomad server on Domino
• CWE-525

IBM Cloud Pak for Security information disclosure

• IBM Cloud Pak for Security
• IBM QRadar Suite Software
• CWE-525

Apache Airflow does not return the "Cache-Control" header for dynamic content

• CWE-525

<2.9.2 · fixed in 2.9.2

IBM Maximo Application Suite information disclosure

• IBM Maximo Application Suite
• IBM Maximo Asset Management
• CWE-525

IBM Aspera Console information disclosure

• IBM Aspera Console
• CWE-525

IBM TXSeries for Multiplatforms information disclosure

• IBM TXSeries for Multiplatforms
• CWE-525

IBM Secure Proxy information disclosure

• IBM Secure Proxy
• CWE-525

IBM Watson CloudPak for Data Data Stores information disclosure

• IBM Watson CloudPak for Data Data Stores
• CWE-525

IBM Cloud Pak for Business Automation information disclosure

• IBM Cloud Pak for Business Automation
• CWE-525

Rack-Cache caches sensitive headers

• CWE-525

>=0.3.0, <1.2 · fixed in 1.2

Siemens Mendix Applications using Mendix 7: A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions <…

• Siemens Mendix Applications using Mendix 7
• Siemens Mendix Applications using Mendix 8
• CWE-525

Cache Manipulation Attack in Apache Traffic Control

• Broken access control
• CWE-525

<5.0.0 · fixed in 5.0.0