PT-2026-76060

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was originally designed to operate without a challenge–response authentication model. This has been changed in versions 6.9.13-48 an...

CVE-2026-51290

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

EUVD-2026-51256

sqlite 3.41 is vulnerable to use after free in the json.c jsonCacheInsert function of the JSON cache management module...

CVE-2026-58218: Insufficient Resource Pool

A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the...

PT-2026-66054

Insufficient validation of untrusted input in BFCache in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

Interpretation Conflict

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached...

Interpretation Conflict

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached response containing...

DEBIAN-CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

UBUNTU-CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives

A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a...

undici: undici: Cross-user information disclosure due to improper Cache-Control directive parsing

A flaw was found in undici. The cache interceptor in undici improperly handles optional whitespace around the equals sign in no-cache or private Cache-Control directives. This vulnerability allows an attacker to bypass cache restrictions, leading to cross-user information disclosure. Specifically...

CVE-2026-14643 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

CVE-2026-14643 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

CVE-2026-14643

undici contains a cache-interceptor vulnerability where optional whitespace around the = in qualified no-cache or private Cache-Control directives is not normalized. In affected releases (7.0.0–7.28.x and 8.0.0–8.8.x), the parser may drop the directive or store a quoted field name, causing a cach...

CVE-2026-14643 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

Information Exposure

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Information Exposure via the cache-control parser in lib/util/cache.js used by interceptors.cache. An attacker can cause a private response to be stored i...