Falhas do tipo CWE-524
92 resultadosArmazenamento de Informações Sensíveis em Cache
A aplicação armazena dados sensíveis (senhas, tokens, chaves, dados pessoais) em cache sem proteção adequada. Um atacante com acesso ao sistema de arquivos, memória ou cache compartilhado consegue recuperar essas informações, comprometendo contas e dados.
Exemplo
Um navegador cachea credenciais de login em texto plano no disco, ou uma API armazena tokens JWT no Redis compartilhado sem criptografia. Qualquer processo ou usuário com acesso ao cache extrai os dados sensíveis.
Como mitigar
Nunca cachear dados sensíveis, ou cacheá-los criptografados com chaves gerenciadas de forma segura. Use marcadores HTTP (Cache-Control: no-store, no-cache) e configure TTL agressivo. Limpe o cache ao fazer logout ou destruir sessões.
CVE-2026-103004MEDIUMnext.js cache leak on warm `use cache` handlers accessing root paramEPSS 0.3%CVE-2026-48901HIGHJoomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objectsEPSS 0.2%CVE-2025-43410LOWThe issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.2EPSS 0.2%CVE-2024-33004MEDIUMInsecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices)EPSS 0.2%CVE-2026-94484MEDIUMNext.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of serviceEPSS 0.2%CVE-2022-32909MEDIUMThe issue was addressed with improved handling of caches. This issue is fixed in iOS 16. An app may be able to access user-sensitive data.EPSS 0.2%CVE-2025-69581MEDIUMAn issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even afteEPSS 0.2%CVE-2026-22741LOWStatic resource cache poisoning in Spring MVC and WebFluxEPSS 0.2%CVE-2023-37517LOWHCL Domino Volt and Domino Leap are affected by missing "no cache" headersEPSS 0.2%CVE-2024-41906MEDIUMA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application does not EPSS 0.2%CVE-2026-32244MEDIUMDiscourse: Cached outdated summaries can leak removed contentEPSS 0.2%CVE-2025-65681LOWAn issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to seEPSS 0.2%CVE-2026-50169MEDIUMAngular Service Worker Policy-Bypass & Credential-Stripping VulnerabilitiesEPSS 0.2%CVE-2026-19202CRITICALToken Cache Reuse in mcp-toolbox-sdk-pythonEPSS 0.2%CVE-2026-47225MEDIUMImproper Search Cache Isolation for Scoped Search API Keys in TypesenseEPSS 0.2%CVE-2026-105711LOWUse of Cache Containing Sensitive Information in GitLabEPSS 0.2%CVE-2026-105752LOWvLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracleEPSS 0.2%CVE-2026-50184MEDIUMAngular: Request Credential & Cache Policy Stripping in Angular Service WorkerEPSS 0.2%CVE-2026-44457MEDIUMHono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakageEPSS 0.2%CVE-2026-107851MEDIUMContao: Improper access control in the table access voterEPSS 0.2%