CWE-524 Use of Cache Containing Sensitive Information

Contao: Improper access control in the table access voter

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

http-cache-semantics max-stale handling can disclose cross-user cached responses

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

Django: cache middleware may expose private responses when unrelated request cookies are present

Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary

Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Next.js: Cache confusion of response bodies for requests with bodies

Directus: Authorization-dependent response served from unsegmented cache key

@angular/service-worker: Request Credential & Cache Policy Stripping

@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.

Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header