mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches

CVE-2026-89186

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and ser

历史摘要 · 未重新核验 · OSV.dev

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angula...

CVE-2026-88059

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

历史摘要 · 未重新核验 · NVD

Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

CVE-2026-88059

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

历史摘要 · 未重新核验 · OSV.dev

Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery meta...

CVE-2026-82755

Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a sha

历史摘要 · 未重新核验 · NVD

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode...

CVE-2026-84933

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refu

历史摘要 · 未重新核验 · NVD

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

CVE-2026-54625

### Summary The CMS page cache key ignores the request headers that plugins declare via `get_vary_cache_on()`. The heade

历史摘要 · 未重新核验 · GitHub Advisory

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public",...

CVE-2026-15743

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static

历史摘要 · 未重新核验 · NVD

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by pl...

CVE-2026-54625

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in

历史摘要 · 未重新核验 · NVD

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain

历史摘要 · 未重新核验 · GitHub Advisory

Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

CVE-2026-59903

### Summary Netty's `CorsHandler` silently overwrites existing `Vary` headers, enabling cache poisoning and sensitive in

历史摘要 · 未重新核验 · GitHub Advisory

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route mi...

CVE-2026-71316

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries

历史摘要 · 未重新核验 · NVD

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

CVE-2026-14643

## Impact Undici's cache interceptor mishandles optional whitespace (OWS) placed around the `=` of a qualified `no-cach

历史摘要 · 未重新核验 · GitHub Advisory

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to be...

CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or priva

历史摘要 · 未重新核验 · NVD

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body ma...

CVE-2026-64648

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr

历史摘要 · 未重新核验 · NVD

Next.js: Response Body Cache Confusion for Requests Containing Bodies

CVE-2026-64648

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr

历史摘要 · 未重新核验 · OSV.dev

Next.js: Cache confusion of response bodies for requests with bodies

CVE-2026-64648

## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to t

历史摘要 · 未重新核验 · GitHub Advisory

Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could conseq...

CVE-2026-64792

Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public gue

历史摘要 · 未重新核验 · NVD

Directus: Authorization-dependent response served from unsegmented cache key

CVE-2026-61836

## Summary When response caching is enabled (`CACHE_ENABLED=true`), the cache-key derivation in `api/src/utils/get-cach

历史摘要 · 未重新核验 · GitHub Advisory

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get...

CVE-2026-61836

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching

历史摘要 · 未重新核验 · NVD

Directus: Authorization-dependent response served from unsegmented cache key

CVE-2026-61836

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching

历史摘要 · 未重新核验 · OSV.dev