Use of Cache Containing Sensitive Information

Every one of the 82 is a mark on the map. Named now: 1 to 26, most at risk first.

1. A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device’s extern…CVE-2021-24027Facebook · 3.8% likely

   Meta (Facebook)

2. The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patternsCVE-2019-9495Wi-Fi Alliance · 3.5% likely

   Wi-Fi Alliance

3. The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an information expose th…CVE-2019-14997Atlassian · 1.2% likely

   Atlassian

4. Coredns: cd bit response is cached and served laterCVE-2024-0874Red Hat · CVSS 5.3 · 0.8% likely

   Red Hat

5. ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusionCVE-2026-82755ash-project · CVSS 6.3 · 0.7% likely

   Ash-Project

6. Directus's session is cached for OpenID and OAuth2 if `redirect` is not usedCVE-2024-45596directus · CVSS 7.4 · 0.7% likely

   Directus

7. An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis.CVE-2021-44854Mediawiki · CVSS 5.3 · 0.7% likely

   Mediawiki

8. Shopware's session is persistent in Cache for 404 pagesCVE-2024-27917shopware · CVSS 7.5 · 0.6% likely

   Shopware

9. http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-staleCVE-2026-93748kornelski · CVSS 7.5 · 0.6% likely
10. Use of Cache Containing Sensitive Information in ikus060/rdiffwebCVE-2022-3292ikus060 · CVSS 4.3 · 0.6% likely

    Ikus060

11. mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared cachesCVE-2026-89186ZenHive · CVSS 6.3 · 0.5% likely

    ZenHive

12. Information Disclosure vulnerability in SAP Commerce (OCC API)CVE-2023-37486SAP_SE · CVSS 5.9 · 0.5% likely

    SAP

13. Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token CacheCVE-2026-85317Apache Software Foundation · CVSS 4.8 · 0.5% likely

    Apache

14. Hono cache middleware ignores "Cache-Control: private" leading to Web Cache DeceptionCVE-2026-24472honojs · CVSS 5.3 · 0.5% likely

    Honojs

15. Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clientsCVE-2026-71316nuxt · CVSS 7.5 · 0.5% likely

    Nuxt

16. Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applicationsCVE-2026-94543vercel · CVSS 6.3 · 0.5% likely

    Vercel

17. kubectl creates world-writeable cached schema filesCVE-2019-11244Kubernetes · CVSS 3.3 · 0.5% likely

    Kubernetes

18. Directus: Authorization-dependent response served from unsegmented cache keyCVE-2026-61836directus · CVSS 8.6 · 0.5% likely

    Directus

19. Libsoup: improper handling of http vary header in libsoup cachingCVE-2025-9901Red Hat · CVSS 5.9 · 0.5% likely

    Red Hat

20. Potential exposure of private data via empty and missing Vary headersCVE-2026-113593djangoproject · CVSS 3.1 · 0.5% likely

    Djangoproject

21. Apache Cocoon: Cross-user cache poisoningCVE-2026-108088Apache Software Foundation · CVSS 7.5 · 0.5% likely

    Apache

22. Information about ECS zero scoped answers might leak to clients that use a specific ECSCVE-2026-40012PowerDNS · CVSS 5.3 · 0.5% likely

    PowerDNS

23. Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview headerCVE-2026-53943TryGhost · CVSS 9.6 · 0.4% likelycovered by CyberSIXT

    TryGhost

24. The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying an Authorization or Proxy-Authorization to different callers.CVE-2026-92443Kong Inc. · CVSS 8.2 · 0.4% likely

    Kong Inc.

25. The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to be served to anothe…CVE-2026-92442Kong Inc. · CVSS 8.3 · 0.4% likely

    Kong Inc.

26. The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, allowing a cached callout response for a…CVE-2026-123041Kong Inc. · CVSS 8.2 · 0.4% likely

    Kong Inc.

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.