CVE-2025-53694

CVE-2025-53694: Divulgación de información en la API de ItemService con un usuario anónimo restringido, que conduce a la exposición de claves de caché mediante un enfoque de fuerza bruta La API de ItemService, accesible en /sitecore/shell/api/sitecore/ItemService/GetChildren, permite a usuarios n...

CVE-2026-35030-PoC

CVE-2026-35030 — Bypass de autenticación en LiteLLM mediante colisión de clave de caché de userinfo OIDC LiteLLM utiliza token:20 como clave de la caché de userinfo OIDC. Dos JWTs distintos firmados con el mismo algoritmo producen los primeros 20 caracteres idénticos , lo que permite a un atacant...

CVE-2026-98005

A flaw was found in the Linux kernel's EROFS Enhanced Read-Only File System component. Due to a missing delimiter between the domain identifier and fingerprint when generating cache keys for shared inodes, the resulting cache entries are ambiguous. A local user could exploit this ambiguity to cau...

DEBIAN-CVE-2026-98005

In the Linux kernel, the following vulnerability has been resolved: erofs: delimit inodeshare cache key components Previously, inodeshare keys were encoded as follows: fingerprint || domainid It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won'...

CVE-2026-98005 erofs: delimit inode_share cache key components

In the Linux kernel, the following vulnerability has been resolved: erofs: delimit inodeshare cache key components Previously, inodeshare keys were encoded as follows: fingerprint || domainid It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won'...

CVE-2026-98005

The Linux kernel contains a vulnerability within the erofs file system regarding the encoding of inode_share cache keys . Previously, keys were encoded as fingerprint || domain_id, which created ambiguity as the fingerprint could be incorrectly parsed as part of a domain ID. The fix involves chan...

CVE-2026-98005

In the Linux kernel, the following vulnerability has been resolved: erofs: delimit inodeshare cache key components Previously, inodeshare keys were encoded as follows: fingerprint || domainid It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won'...

CVE-2026-98005 erofs: delimit inode_share cache key components

In the Linux kernel, the following vulnerability has been resolved: erofs: delimit inodeshare cache key components Previously, inodeshare keys were encoded as follows: fingerprint || domainid It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won'...

CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter

CVE-2026-11101 – Envenenamiento de caché HTTP mediante un parámetro de consulta no clave Descripción general Una caché web utiliza únicamente la ruta de la URL como clave de caché, ignorando los parámetros de consulta. Un atacante puede añadir una carga útil maliciosa a un parámetro no clave p...

Linux Distros Unpatched Vulnerability : CVE-2026-98005

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - erofs: delimit inodeshare cache key components Previously, inodeshare keys were encoded as follows: fingerprint || domainid It would be better to have a separat...

CVE-2026-14441

A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and prevent potential...

EUVD-2026-86470

A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and prevent potential...

CVE-2026-14441 Logic flaw in SANnav Java cache key handling object comparison handling

A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and prevent potential...

CVE-2026-14441

A logic flaw in the Java cache key handling of Brocade SANnav allows for improper identifier resolution when processing specific user account structures. This vulnerability exists in SANnav versions before 3.0.1a . The issue has been remediated by updating the internal comparison routines to ensu...

WordPress APCu Manager plugin < 4.5.0 - Unauthenticated Stored XSS via Cache Key Pollution vulnerability

Unauthenticated Stored XSS via Cache Key Pollution vulnerability discovered by Alessandro Greco aka Aleff, Giovanbattista Ianni University of Calabria - UNICAL in WordPress Plugin APCu Manager versions 4.5.0...

grafana: Grafana: Session takeover via Auth Proxy cache key collision

On instances using Auth Proxy header authentication auth.proxy with identity caching enabled syncttl 0, two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged...

CVE-2026-79713

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from...

Linux Distros Unpatched Vulnerability : CVE-2026-90102

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct...

CVE-2026-79713: Inconsistent Interpretation of HTTP Requests

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from...

CVE-2026-90102: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...