CVE-2026-93750

MediumCVSS 5.9/10Last modified Sep 23, 2026

Description

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-436

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-937516.5uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded se CVE-2026-937527.5CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property CVE-2026-937537.5deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys bein CVE-2026-937567.2The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CVE-2026-937588.1An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic appl CVE-2026-937598.6Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-CVE-2026-93766.3A vulnerability was determined in JPress up to 1.0.3. The affected element is an unknown function of the file /ucenter/article/doWriteSave o CVE-2026-937608.2Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-b CVE-2026-937617.5An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthent CVE-2026-937629.8Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally suppl CVE-2026-937636.5A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application decl CVE-2026-937646.5Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Appl