Renaming or Tightness: Enforcing Disjunctive Information Flow Policies
本文研究的是编程语言中的信息流控制策略，特别关注一种被称为“析取策略”（disjunctive policy）的机制。在传统格模型（lattice model）中，信息流策略通常要求安全级别构成一个格，从而可以定义“上界”来控制信息的汇聚。
2026-08-11 归档
今日共收录 1506 条安全情报，包含 770 个 CVE，368 篇安全通告，以及 83 篇研究论文。
← 返回归档列表A Combined Feature-Based Framework for Disguise and Spoofing Detection in Face Recognition Systems
本文针对人脸识别系统面临的两类常见但通常被分开处理的失败模式——欺骗攻击和伪装变化——提出并比较了五种结合特征提取与分类的流水线框架。欺骗攻击指冒名者使用授权用户的照片或视频尝试通过认证；伪装变化指合法用户因配饰、胡须、光照或姿态等外观变化
SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating ...
CVE-2026-58236
SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing securit
SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed i...
CVE-2026-58235
SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related applicat...
CVE-2026-44765
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet...
CVE-2026-44764
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated
SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Expl...
CVE-2026-44763
SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation
SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which could enable an auth...
CVE-2026-44762
SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks c
SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands. An unauthenticated attacker could send specially crafted requests that trigger a...
CVE-2026-40130
SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands. An unauthenticated atta
tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optva...
CVE-2026-8718
tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, T
react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f...
CVE-2026-48161
react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contain
The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structure that holds the CoAP block context,...
CVE-2026-11812
The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single fi
The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-setup failure paths. ...
CVE-2026-11811
The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS
Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution...
CVE-2025-30241
Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input pro
The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage medi...
CVE-2025-30240
The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By
In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to ...
CVE-2025-30239
In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive co
In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may...
CVE-2025-30238
In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to e
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker ca...
CVE-2025-30237
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not c
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the channels.convertToT...
CVE-2026-72919
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user ...
CVE-2026-72918
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7