CWE-524: Use of Cache Containing Sensitive Information
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
58 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-53943 — Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header
- CVE-2025-64762 — authkit-nextjs may let session cookies be cached in CDNs
- CVE-2024-27917 — Shopware's session is persistent in Cache for 404 pages
- CVE-2026-61836 — Directus: Authorization-dependent response served from unsegmented cache key
- CVE-2026-13007 — Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure
- CVE-2026-50170 — Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
- CVE-2026-25540 — Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)
- CVE-2025-61598 — Discourse is missing Cache-Control response header on error responses
- CVE-2024-41906 — A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected a
- CVE-2026-65755 — Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension
- CVE-2026-64792 — Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions
- CVE-2026-71316 — Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
- CVE-2025-57752 — Next.js Affected by Cache Key Confusion for Image Optimization API Routes
- CVE-2026-25703 — Potential information leakage from manager /network/graph API in NeuVector
- CVE-2025-69202 — axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header
- CVE-2025-14806 — IBM Planning Analytics Information Disclosure
- CVE-2025-5141 — Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache
- CVE-2026-84933 — undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
- CVE-2026-59903 — Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
- CVE-2026-24472 — Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception
Recently published
- CVE-2026-82755 — ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
- CVE-2026-84933 — undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
- CVE-2026-15743 — Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable
- CVE-2026-54625 — django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
- CVE-2026-59903 — Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
- CVE-2026-71316 — Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
- CVE-2026-25703 — Potential information leakage from manager /network/graph API in NeuVector
- CVE-2026-14643 — undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
- CVE-2026-64648 — Next.js: Response Body Cache Confusion for Requests Containing Bodies
- CVE-2026-65755 — Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension
- CVE-2026-64792 — Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions
- CVE-2026-61836 — Directus: Authorization-dependent response served from unsegmented cache key
- CVE-2026-0281 — PAN-OS: Information Disclosure Vulnerability in Management Web Interface
- CVE-2026-59213 — Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
- CVE-2026-48588 — Potential exposure of private data via cached Set-Cookie response
- CVE-2026-49858 — API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate
- CVE-2026-53943 — Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header
- CVE-2026-13007 — Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure
- CVE-2026-50184 — Angular: Request Credential & Cache Policy Stripping in Angular Service Worker
- CVE-2026-50169 — Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
More specific weaknesses
- CWE-525 — Use of Web Browser Cache Containing Sensitive Information