CVE-2026-74916 WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served...

CVE-2025-53694

CVE-2025-53694: Information Disclosure in ItemService API with a restricted anonymous user, leading to exposure of cache keys using a brute-force approach The ItemService API, accessible at /sitecore/shell/api/sitecore/ItemService/GetChildren, allows unauthenticated users to query the Sitecore...

CVE-2026-35030-PoC

CVE-2026-35030 — Bypass de autenticación en LiteLLM mediante colisión de clave de caché de userinfo OIDC LiteLLM utiliza token:20 como clave de la caché de userinfo OIDC. Dos JWTs distintos firmados con el mismo algoritmo producen los primeros 20 caracteres idénticos , lo que permite a un atacant...

CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter

CVE-2026-11101 – Avvelenamento della cache HTTP tramite parametro di query non incluso nella chiave Panoramica Una cache web utilizza solo il percorso dell'URL come chiave della cache, ignorando i parametri di query. Un attaccante può aggiungere un payload dannoso a un parametro non incluso nella...

Directory Traversal

Overview next is a react framework. Affected versions of this package are vulnerable to Directory Traversal in FileSystemCache.getFilePath in packages/next/src/server/lib/incremental-cache/file-system-cache.ts. An attacker can trigger remote code execution on a Windows-hosted server by sending a...

EUVD-2026-63564

django CMS: Page cache ignores plugin-declared Vary headers disclosure & poisoning...

CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

PT-2026-79093

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 django CMS version 5.1.0a1 Description The page cache in cms/cache/page.py ignores request headers declared by plugins through the get vary cache on function. While the page cache key function includes the...

CVE-2026-18051 W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

CVE-2026-18051

The W3 Total Cache WordPress plugin before 2.10.5 fails to validate the page cache key request path, enabling unauthenticated attackers to perform path traversal and write or overwrite arbitrary files anywhere on the server, including .htaccess on Apache. CVSS 10.0 (Critical) reflects no auth, no...

CVE-2026-73846

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...

CVE-2026-73846 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...

CVE-2026-73846

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...

CVE-2026-73846 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...

Denial Of Service (DoS)

Spring Data Commons is vulnerable to Denial Of Service. The vulnerability is due to attacker-supplied strings being permanently retained as internal property-lookup cache keys, allowing repeated requests to exhaust application heap memory...

CVE-2026-15239

CVE-2026-15239 affects the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin (pre-1.42.0). The vulnerability arises because the Turnstile validation cache isn’t bound to the single-use challenge token, instead tying to an attacker-controlled reusable request value, enabling unauthenticate...

CVE-2026-15239 Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solv...

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

SummaryThe getallmodels handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of keybuilder=. In aiocache 0.12.3 the pinned version, key= is a static cache...

PYSEC-2026-3589 Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Summary The getallmodels handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of keybuilder=. In aiocache 0.12.3 the pinned version, key= is a static cache...

CVE-2026-68945

A flaw was found in Angular's HttpTransferCache component. This component, used for caching HTTP requests during server-side rendering, incorrectly generates cache keys when repeated request parameters are present, causing semantically different requests to share the same cache key. This cache-ke...