CWE-525 Use of Web Browser Cache Containing Sensitive Information
Description
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-525 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-4cwx-7wf7-3272 | CVE-2026-13697 | HIGH |
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives |
2026-08-03 | |
| GHSA-6vgg-xhvh-38ff | - | LOW |
nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store |
2026-06-12 | |
| GHSA-c57f-mm3j-27q9 | CVE-2026-41322 | MODERATE |
Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed |
2026-04-27 | |
| GHSA-mhpg-hpj5-73r2 | CVE-2025-13083 | LOW | - |
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels |
2026-01-08 |
| GHSA-6533-fhr2-f38h | CVE-2025-62276 | MODERATE |
Liferay Portal and DXP use an incorrect cache-control header |
2025-11-15 | |
| GHSA-hq75-xg7r-rx6c | - | MODERATE |
Better Call routing bug can lead to Cache Deception |
2025-07-11 | |
| GHSA-f3fg-mf2q-fj3f | CVE-2025-48947 | HIGH |
NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies |
2025-06-04 | |
| GHSA-9xpj-62mm-24h2 | CVE-2024-25142 | LOW |
Apache Airflow does not return the "Cache-Control" header for dynamic content |
2025-01-21 | |
| GHSA-fw5r-6m3x-rh7p | CVE-2024-45314 | MODERATE |
Flask-AppBuilder's login form allows browser to cache sensitive fields |
2024-11-18 | |
| GHSA-hrp6-w4v2-8737 | CVE-2012-2671 | MODERATE |
Rack-Cache caches sensitive headers |
2023-03-27 | |
| GHSA-pw59-4qgf-jxr8 | CVE-2020-17522 | MODERATE |
Cache Manipulation Attack in Apache Traffic Control |
2022-04-04 |