Skip to content
OpenAdvisories

Weakness (CWE)

CWE-524: Use of Cache Containing Sensitive Information

Base Incomplete

The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

How to prevent it (3 mitigations)

  1. Architecture and Design

    Protect information stored in cache.

  2. Architecture and Design

    Do not store unnecessarily sensitive information in the cache.

  3. Architecture and Design

    Consider using encryption in the cache.

Source: MITRE CWE-524

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-94386 Public exploit

    Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache

    Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component. This issue affects Apache Camel: from 4.19.0 before 4.22.2. OAuthClientCredentialsTokenResolver obtains OAuth 2.0 bearer tokens through the client credentials grant o…

    Apache Software Foundation Apache Camel
  • Medium 4.8
    CVE-2026-85317 Public exploit

    Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache

    Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several o…

    Apache Software Foundation Apache Camel
  • Medium 6.5
    CVE-2026-59903 Public exploit

    Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

    Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a…

    netty netty netty netty Debian Ubuntu Maven
  • Medium 5.5
    CVE-2025-69581 Public exploit

    An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user …

  • Low 3.3
    CVE-2025-65681 Public exploit

    Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control

    An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.

    tutor PyPI
  • Unscored —
    CVE-2021-24027 Public exploit

    A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may h…

    Facebook WhatsApp for Android WhatsApp Business for Android Android