CVE-2026-47225

The record

Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is a cache isolation issue affecting search requests that use both server-side search result caching and Scoped Search API Keys. Under specific request ordering, cached search results could be reused across requests with different Scoped Search API Key constraints. This could result in a request receiving search results that should have been restricted by its Scoped Search API Key. This issue only affects search requests that use both server-side search result caching and Scoped Search API Keys with embedded filters to restrict access to search results within a collection. This vulnerability may result in unintended disclosure of search results across scoped authorization contexts. This issue has been patched in versions 29.1 and 30.2.

Affected packages

Related vulnerabilities

• CVE-2026-105711 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before… CWE-524
• CVE-2026-105752 vLLM is an inference and serving engine for large language models. CWE-524
• CVE-2026-94543 Next.js is a React framework for building full-stack web applications. CWE-524
• CVE-2026-94484 Next.js is a React framework for building full-stack web applications. CWE-524
• CVE-2026-93748 http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache… CWE-524
• CVE-2026-88059 Angular is a development platform for building mobile and desktop web applications using… CWE-524
• CVE-2026-82755 Use of Cache Containing Sensitive Information vulnerability in ash-project… CWE-524
• CVE-2026-84933 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its… CWE-524