The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
Volume of CVEs assigned to CWE-524 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
59 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-53943CRITICAL Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared between different visitors | Jun 24, 2026 | 9.6 | 40 | NO | NO |
CVE-2026-61836HIGH Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-ca | Jul 15, 2026 | 8.6 | 36 | NO | NO |
CVE-2026-0281HIGH An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web | Jul 9, 2026 | 7.1 | 33 | NO | NO |
CVE-2026-13007HIGH Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, | Jun 23, 2026 | 7.5 | 32 | NO | NO |
CVE-2026-50170HIGH Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2 | Jun 22, 2026 | 7.5 | 31 | NO | NO |
CVE-2026-48588MEDIUM An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
`UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the inc | Jul 7, 2026 | 5.3 | 29 | NO | NO |
CVE-2026-49858MEDIUM API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JS | Jul 1, 2026 | 5.9 | 29 | NO | NO |
CVE-2026-9678MEDIUM Impact:
Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache fi | Jun 17, 2026 | 5.9 | 29 | NO | NO |
CVE-2026-46309HIGH In the Linux kernel, the following vulnerability has been resolved:
drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise
Add validation in xe_vm_madvise_ioctl( | Jun 8, 2026 | 7.0 | 29 | NO | NO |
CVE-2026-35172HIGH Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage. | Apr 6, 2026 | 7.5 | 29 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.