CVE-2026-82755 is a vulnerability in ash-project's ash_authentication_oauth2_server where sensitive OAuth discovery metadata intended for one tenant can be cached and served to another tenant due to improper cache control headers. This occurs because tenant-specific metadata endpoints are sent with Cache-Control: public and no Vary header, causing shared HTTP caches to serve cached responses across tenants. This can lead to clients sending authorization codes and secrets to incorrect token endpoints and validating tokens against wrong keys. The issue affects versions from 0.1.3 up to but not including 0.3.1.
CVE-2026-15743 is a vulnerability in Catalyst::Plugin::Static::Simple for Perl versions up to 0.38. The _serve_static method improperly sets the Cache-Control header to "public" regardless of configuration, causing sensitive responses to be cached in shared caches. Attempts to disable caching by setting expires to "0" are ignored, potentially exposing sensitive data to unauthorized users via shared caches.
A vulnerability in django CMS page cache prior to version 5.0.8 and in 5.1.0a1 causes the cache key to ignore certain request headers declared by plugins. This can lead to cache poisoning where one visitor may receive content intended for another visitor, and an unauthenticated attacker can prime the cache with malicious content. The issue is fixed in versions 5.0.8 and 5.1.0.
CVE-2026-25703 is a high-severity vulnerability in SUSE NeuVector versions up to and including 5.4.9. It involves missing authentication for the critical /network/graph API in the manager component, which can lead to potential information leakage through cached sensitive data.
Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10 contain a vulnerability where server-side fetch calls with a request body may return cached response bodies from different requests to the same URL but with different bodies. This can cause confidential data leakage between unauthorized requests. The issue arises when fetch is called with differing init parameters, leading to unsafe caching behavior. The vulnerability has been fixed in versions 15.5.21 and 16.2.11.
Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable.
Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors.
An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker.
The security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
`UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Chris Whyland for reporting this issue.
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.12.
Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared between different visitors, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response. In affected cache configurations, that response could be stored and served to subsequent visitors requesting the same page, allowing cache poisoning of request-specific preview output. When running Ghost's frontend and admin panel on the same domain this could be used to take over staff user accounts. When running these on different domains staff accounts have no exposure. This vulnerability is fixed in 6.37.0.
Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
A vulnerability in Django's UpdateCacheMiddleware allows private cached responses to be read by unauthenticated remote attackers. This occurs because the middleware does not add the Authorization header to the Vary response header for requests that include Authorization without Cache-Control: public. The issue affects Django versions 5.2 before 5.2.15 and 6.0 before 6.0.6. Earlier unsupported versions may also be affected. The vulnerability has a low severity score and no known exploits in the wild.
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.
Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial
lookups when processing untrusted input. A remote attacker could possibly
use this issue to make outbound network requests, write arbitrary files, or
execute arbitrary code. This issue was only addressed in Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-15307)
Ahmad Sadeddin discovered that Django UpdateCacheMiddleware incorrectly
cached requests where the Vary header contained an asterisk. A remote
attacker could possibly use this issue to obtain sensitive information.
(CVE-2026-6907)
Ahmed Badawe discovered that Django did not properly parse Cache-Control
response directives case-insensitively under certain circumstances. A
remote attacker could possibly use this issue to view sensitive information
from responses that were incorrectly cached. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-8404)
Spring MVC and WebFlux applications using Spring Framework versions 5.3.0, 6.1.0, 6.2.0, and 7.0.0 are vulnerable to cache poisoning when resolving static resources with resource chain support and caching enabled. An attacker can poison the resource cache with incorrectly encoded resources, potentially causing denial of service by breaking the front-end application for clients. This vulnerability requires specific configuration conditions and user interaction. The CVSS score is low, indicating limited impact.
CVE-2025-14806 is a medium severity vulnerability in IBM Planning Analytics Local versions 2.1.0 through 2.1.17. It involves improper caching behavior where sensitive, user-specific data can be stored and served as publicly cacheable resources. An attacker with limited privileges and requiring user interaction can exploit this to access confidential information. The vulnerability does not impact integrity or availability but poses a significant confidentiality risk. No known exploits are currently reported in the wild. Organizations using affected versions should prioritize patching or implementing mitigations to prevent sensitive data leakage via caching mechanisms.
Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3.
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does not respect standard cache control headers such as `Cache-Control: private` or `Cache-Control: no-store`, which may result in private or authenticated responses being cached and subsequently exposed to unauthorized users. Version 4.11.7 has a patch for the issue.
Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization bypass. The cache key is generated only from the URL, ignoring request headers like `Authorization`. When the server responds with `Vary: Authorization` (indicating the response varies by auth token), the library ignores this, causing all requests to share the same cache regardless of authorization. Server-side applications (APIs, proxies, backend services) that use axios-cache-interceptor to cache requests to upstream services, handle requests from multiple users with different auth tokens, and upstream services replies on `Vary` to differentiate caches are affected. Browser/client-side applications (single user per browser session) are not affected. Services using different auth tokens to call upstream services will return incorrect cached data, bypassing authorization checks and leaking user data across different authenticated sessions. After `v1.11.1`, automatic `Vary` header support is now enabled by default. When server responds with `Vary: Authorization`, cache keys now include the authorization header value. Each user gets their own cache.