the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

CVE-2026-67602 — phpIPAM 1.8.2 REST API Authentication Bypass Unauthenticated authentication bypass in the phpIPAM REST API, caused by an object-cache key collision: the database row cached while resolving an API app's appid satisfies the subsequent appcode token check whenever the supplied token...

CVE-2026-19300 Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields...

EUVD-2026-58728

CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning...

CVE-2026-80047

A vulnerability in Hugging Face Transformers versions = 4.49.0 and = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

CVE-2026-80047

Hugging Face Transformers (versions 4.49.0 through 5.8.1) contains a consent-bypass flaw in GenerativePreTrainedModel.load_custom_generate() . The function fetches and writes a remote Python module to ~/.cache/huggingface/modules via an unconditional file copy in dynamic_module_utils.py before ev...

EUVD-2026-69144

A vulnerability in Hugging Face Transformers versions = 4.49.0 and = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

Security Bulletin: Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows

Summary Langflow contains two authenticated information disclosure vulnerabilities. The MCP Tools component caches discovered tools in a shared process-local cache keyed only by the MCP server display name without including the user, session, flow, or resolved configuration; when two authenticate...

CVE-2026-73846

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...

CVE-2026-73846

The CVE describes a vulnerability in CKAN MCP Server prior to version 0.4.112 where canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters. This causes different logical parameter sets used by buildCacheKey to coll...

GHSA-C6W9-5G5J-JH2P Directus: Authorization-dependent response served from unsegmented cache key

Summary When response caching is enabled CACHEENABLED=true, the cache-key derivation in api/src/utils/get-cache-key.ts includes only version, path, query, and accountability.user plus a conditional ip. Authorization context beyond user share, role, roles, admin, app, policies is not part of the...

CVE-2026-16158

CVE-2026-16158 affects @fastify/reply-from. The vulnerability stems from how the internal URL cache key is built by concatenating the destination and source paths without a delimiter in versions 8.3.1 up to (but not including) 12.6.4. This can cause key collisions where different upstreams resolv...

mercure has Topic Selector Cache Key Collision

Impact A cache key collision vulnerability in TopicSelectorStore allows an attacker to poison the match result cache, potentially causing private updates to be delivered to unauthorized subscribers or blocking delivery to authorized ones. The cache key was constructed by concatenating the topic...

GHSA-HWR4-MQ23-WCV5 mercure has Topic Selector Cache Key Collision

Impact A cache key collision vulnerability in TopicSelectorStore allows an attacker to poison the match result cache, potentially causing private updates to be delivered to unauthorized subscribers or blocking delivery to authorized ones. The cache key was constructed by concatenating the topic...

CVE-2026-35030

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.83.0, when JWT authentication is enabled enablejwtauth: true, the OIDC userinfo cache uses token:20 as the cache key. JWT headers produced by the same signing algorithm generate identical first 20...

CVE-2026-35039 fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)

fast-jwt provides fast JSON Web Token JWT implementation. From 0.0.1 to before 6.2.0, setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification proce...

LiteLLM: Authentication bypass via OIDC userinfo cache key collision

Impact When JWT authentication is enabled enablejwtauth: true, the OIDC userinfo cache uses token:20 as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters. This configuration option is not enabled by default. Most instances are not affected. A...

GHSA-JHP4-JVQ3-W5XR Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions

Impact The ConfigKeyCache uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. Patches The...

CVE-2026-25480 FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode NFKD normalization and ord substitution without separators, creating key collisions. When FileStore is used as response-cache backend, an unauthenticated remo...

CVE-2025-71105

CVE-2025-71105 documents a Linux kernel issue in f2fs where two slab caches (f2fs_xattr_entry-7:3 and f2fs_xattr_entry-7:7) with identical slab sizes cause kmem_cache_sanity_check warnings during mount operations. The root cause is using per-sb slab caches instead of a single global slab, leading...

CVE-2021-41329

Datalust Seq before 2021.2.6259 allows users with view filters applied to their accounts to see query results not constrained by their view filter. This information exposure, caused by an internal cache key collision, occurs when the user's view filter includes an array or IN clause, and when...