CVE-2025-53694

CVE-2025-53694: Information Disclosure in ItemService API with a restricted anonymous user, leading to exposure of cache keys using a brute-force approach The ItemService API, accessible at /sitecore/shell/api/sitecore/ItemService/GetChildren, allows unauthenticated users to query the Sitecore...

CVE-2026-113593

A flaw was found in Django. This vulnerability leads to information disclosure due to improper cache key generation when handling HTTP headers. The caching mechanism treats web requests that omit a specified header identically to requests that supply the header with an empty value. As a result, a...

CVE-2026-35030-PoC

CVE-2026-35030 — LiteLLM Authentication Bypass via OIDC Userinfo Cache Key Collision LiteLLM OIDC userinfo cache uses token:20 as the cache key. Two different JWTs signed with the same algorithm produce identical first 20 characters , allowing an unauthenticated attacker to inherit another user's...

CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter

CVE-2026-11101 – HTTP Cache Poisoning via Unkeyed Query Parameter Overview A web cache uses only the URL path as the cache key, ignoring query parameters. An attacker can append a malicious payload to an unkeyed parameter e.g., utmcampaign and poison the cache. Subsequent visitors receive the...

EUVD-2026-122965

The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to be served to another...

EUVD-2026-122960

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname from the cache key which may allow a response cached for a hostname to be served for another...

EUVD-2026-123056

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache key, allowing a remote attacker to cause a response cached for one request to be served for a different request on the same Route...

Node.js < 22.23.5, < 24.22.3, < 26.13.1 - Improper Certificate Validation via an https.Agent Session Cache Key Collision Between Omitted and Empty ca leading to Cross-Policy Session Reuse

Improper Certificate Validation via an https.Agent Session Cache Key Collision Between Omitted and Empty ca leading to Cross-Policy Session Reuse vulnerability discovered by ? in WordPress npm Node.js versions 26.13.1...

CVE-2026-92545

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname from the cache key which may allow a response cached for a hostname to be served for another...

CVE-2026-92558

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache key, allowing a remote attacker to cause a response cached for one request to be served for a different request on the same Route...

CVE-2026-92558

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway are vulnerable to an improper encoding or escaping issue (CWE-116 ). The root cause is the failure to escape separator characters when constructing the cache key . This flaw allows a remote attacker to...

CVE-2026-92558

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache key, allowing a remote attacker to cause a response cached for one request to be served for a different request on the same Route...

CVE-2026-92442

The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to be served to another...

CVE-2026-92442

The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise is vulnerable to a cache poisoning issue because it omits the caller's identity from the cache key. This flaw allows a response cached for one user to be incorrectly served to another. No specific exploit details or remediation ve...

CVE-2026-92545

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway are vulnerable to a cache poisoning issue. The root cause is that these plugins omit the request hostname from the cache key, which may lead to a response cached for one hostname being served to anothe...

CVE-2026-92545

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname from the cache key which may allow a response cached for a hostname to be served for another...

PT-2026-144834

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache key, allowing a remote attacker to cause a response cached for one request to be served for a different request on the same Route...

CVE-2026-123041: Kong Inc.: The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client…

The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, allowing a cached callout response for a caller to be served to another...

CVE-2026-92545: Kong Inc.: The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request…

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname from the cache key which may allow a response cached for a hostname to be served for another...

CVE-2026-92442: Kong Inc.: The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key,…

The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to be served to another...