Monthly
Catalyst::Plugin::Static::Simple through 0.38 unconditionally marks all static file responses as publicly cacheable via Cache-Control: public, including responses to requests bearing an Authorization header. This means shared HTTP proxies may cache authenticated responses and serve them to subsequent unauthenticated requestors. The documented mitigation of setting expires to 0 is silently ignored, leaving operators with no effective means to restrict caching behavior until the patch is applied. No public exploit or CISA KEV entry exists; EPSS is 0.18% (8th percentile), indicating low opportunistic exploitation probability.
Netty's CorsHandler silently overwrites any application-set Vary headers with only 'Vary: Origin', enabling caching proxies and CDNs to conflate and serve authenticated, user-specific HTTP responses to unauthorized requesters. Affected are all Netty deployments running netty-codec-http prior to 4.1.137.Final or 4.2.17.Final where applications set per-user Vary headers (e.g., Vary: Authorization or Vary: Cookie) and are deployed behind a caching layer. No public exploit identified at time of analysis; vendor-released patches are confirmed available in 4.1.137.Final and 4.2.17.Final.
Cross-user SSR payload disclosure in Nuxt 4.x allows unauthenticated network attackers to retrieve another authenticated user's full server-side rendered data by fetching `/<page>/_payload.json` after any authenticated user has warmed a cached route. The runtime `cache:nuxt:payload` storage introduced in nuxt 4.4.0 keyed payloads by URL path alone - omitting cookie, authorization header, or `cache.varies` dimensions - causing the renderer to serve one user's SSR data (including `useFetch`/`useAsyncData` results such as profile, tenant, billing, and token-like values) to any subsequent requester. No public exploit identified at time of analysis; vendor-released patch is available as nuxt@4.5.1.
Information disclosure in Regular Labs Articles Anywhere and Users Anywhere extensions for Joomla allows unauthenticated remote attackers to view content that should be expired or unpublished. Date-sensitive query caching generates cache keys lacking a bounded time component, so results cached during a valid period persist and can be served after content becomes unavailable. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low probability of widespread exploitation.
Cache confusion in Next.js App Router's server-side fetch patch leaks confidential POST response bodies across unrelated requests targeting the same URL. Applications on Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 that call `fetch(new Request(init), aDifferentInit)` server-side are at risk of cross-user data exposure - one user's POST response (potentially containing session tokens, PII, or financial data) may be returned to a different user's request. No public exploit has been identified at time of analysis, and Pages Router deployments are explicitly unaffected.
Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administrator-only content indexed via Smart Search. Affected extensions include Articles Anywhere, Conditional Content, Modules Anywhere, ReReplacer, Sourcerer, Snippets Pro, and Tabs & Accordions Pro. No public exploit or active exploitation is known, and EPSS probability is low (0.19%).
Cross-context cache disclosure in Directus before 12.0.0 lets share-token holders and anonymous clients receive permission-filtered responses that were cached for a differently-scoped principal, because the cache key omits authorization context. When response caching is enabled, the key derived in api/src/utils/get-cache-key.ts covers only version, path, query, and accountability.user; since share tokens and anonymous requests both collapse to user null, requests to the same URL and query share a cache bucket and skip permission re-evaluation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is a straightforward, config-dependent information-disclosure issue fixed in 12.0.0.
Web session token theft from PAN-OS management interfaces affects PA-Series and VM-Series firewalls and Panorama deployments, enabling a network-adjacent unauthenticated attacker to hijack authenticated administrator sessions. Exploitation depends on a legitimate management user clicking an attacker-crafted malicious link while an active session exists - a social engineering prerequisite that substantially reduces real-world risk. No public exploit code exists (CVSS 4.0 E:U) and the issue is not listed in CISA KEV; the vendor rates overall CVSS 4.0 severity at 2.1, reflecting these mitigating factors.
Cache key misconfiguration in Open WebUI versions 0.6.27 through 0.9.x leaks permission-filtered model lists across authenticated users during the aiocache TTL window. The flaw exists in both the OpenAI and Ollama router handlers, where a lambda was incorrectly passed as the cache key instead of a per-user key_builder, collapsing all users into a single shared cache entry. An authenticated attacker on a shared instance can receive a different user's model list - revealing which AI models that user has access to - with no public exploit identified at time of analysis and a vendor-released patch available in v0.10.0.
Cache poisoning in Django's UpdateCacheMiddleware and cache_page() decorator exposes private user data to unauthenticated remote attackers by incorrectly serving cached responses across different cookie contexts. Versions 6.0 before 6.0.7 and 5.2 before 5.2.16 are confirmed affected; older unsupported branches (5.0.x, 4.1.x, 3.2.x) were not evaluated but may share the flaw. No public exploit or CISA KEV listing exists at time of analysis, and the low CVSS 4.0 score of 2.3 reflects meaningful preconditions, though the data-disclosure consequence for applications serving personalized, cookie-gated content through a shared cache is concrete.
Catalyst::Plugin::Static::Simple through 0.38 unconditionally marks all static file responses as publicly cacheable via Cache-Control: public, including responses to requests bearing an Authorization header. This means shared HTTP proxies may cache authenticated responses and serve them to subsequent unauthenticated requestors. The documented mitigation of setting expires to 0 is silently ignored, leaving operators with no effective means to restrict caching behavior until the patch is applied. No public exploit or CISA KEV entry exists; EPSS is 0.18% (8th percentile), indicating low opportunistic exploitation probability.
Netty's CorsHandler silently overwrites any application-set Vary headers with only 'Vary: Origin', enabling caching proxies and CDNs to conflate and serve authenticated, user-specific HTTP responses to unauthorized requesters. Affected are all Netty deployments running netty-codec-http prior to 4.1.137.Final or 4.2.17.Final where applications set per-user Vary headers (e.g., Vary: Authorization or Vary: Cookie) and are deployed behind a caching layer. No public exploit identified at time of analysis; vendor-released patches are confirmed available in 4.1.137.Final and 4.2.17.Final.
Cross-user SSR payload disclosure in Nuxt 4.x allows unauthenticated network attackers to retrieve another authenticated user's full server-side rendered data by fetching `/<page>/_payload.json` after any authenticated user has warmed a cached route. The runtime `cache:nuxt:payload` storage introduced in nuxt 4.4.0 keyed payloads by URL path alone - omitting cookie, authorization header, or `cache.varies` dimensions - causing the renderer to serve one user's SSR data (including `useFetch`/`useAsyncData` results such as profile, tenant, billing, and token-like values) to any subsequent requester. No public exploit identified at time of analysis; vendor-released patch is available as nuxt@4.5.1.
Information disclosure in Regular Labs Articles Anywhere and Users Anywhere extensions for Joomla allows unauthenticated remote attackers to view content that should be expired or unpublished. Date-sensitive query caching generates cache keys lacking a bounded time component, so results cached during a valid period persist and can be served after content becomes unavailable. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low probability of widespread exploitation.
Cache confusion in Next.js App Router's server-side fetch patch leaks confidential POST response bodies across unrelated requests targeting the same URL. Applications on Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 that call `fetch(new Request(init), aDifferentInit)` server-side are at risk of cross-user data exposure - one user's POST response (potentially containing session tokens, PII, or financial data) may be returned to a different user's request. No public exploit has been identified at time of analysis, and Pages Router deployments are explicitly unaffected.
Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administrator-only content indexed via Smart Search. Affected extensions include Articles Anywhere, Conditional Content, Modules Anywhere, ReReplacer, Sourcerer, Snippets Pro, and Tabs & Accordions Pro. No public exploit or active exploitation is known, and EPSS probability is low (0.19%).
Cross-context cache disclosure in Directus before 12.0.0 lets share-token holders and anonymous clients receive permission-filtered responses that were cached for a differently-scoped principal, because the cache key omits authorization context. When response caching is enabled, the key derived in api/src/utils/get-cache-key.ts covers only version, path, query, and accountability.user; since share tokens and anonymous requests both collapse to user null, requests to the same URL and query share a cache bucket and skip permission re-evaluation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is a straightforward, config-dependent information-disclosure issue fixed in 12.0.0.
Web session token theft from PAN-OS management interfaces affects PA-Series and VM-Series firewalls and Panorama deployments, enabling a network-adjacent unauthenticated attacker to hijack authenticated administrator sessions. Exploitation depends on a legitimate management user clicking an attacker-crafted malicious link while an active session exists - a social engineering prerequisite that substantially reduces real-world risk. No public exploit code exists (CVSS 4.0 E:U) and the issue is not listed in CISA KEV; the vendor rates overall CVSS 4.0 severity at 2.1, reflecting these mitigating factors.
Cache key misconfiguration in Open WebUI versions 0.6.27 through 0.9.x leaks permission-filtered model lists across authenticated users during the aiocache TTL window. The flaw exists in both the OpenAI and Ollama router handlers, where a lambda was incorrectly passed as the cache key instead of a per-user key_builder, collapsing all users into a single shared cache entry. An authenticated attacker on a shared instance can receive a different user's model list - revealing which AI models that user has access to - with no public exploit identified at time of analysis and a vendor-released patch available in v0.10.0.
Cache poisoning in Django's UpdateCacheMiddleware and cache_page() decorator exposes private user data to unauthenticated remote attackers by incorrectly serving cached responses across different cookie contexts. Versions 6.0 before 6.0.7 and 5.2 before 5.2.16 are confirmed affected; older unsupported branches (5.0.x, 4.1.x, 3.2.x) were not evaluated but may share the flaw. No public exploit or CISA KEV listing exists at time of analysis, and the low CVSS 4.0 score of 2.3 reflects meaningful preconditions, though the data-disclosure consequence for applications serving personalized, cookie-gated content through a shared cache is concrete.