An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this ...

CVE-2026-90456

该条目来自 NVD，描述 CVE-2026-90456：某打包分发的库存管理组件（inventory-management component）在随附的“示例环境配置文件”中内置了一个固定且公开可知的管理员口令。该示例文件本身是部署模板，正

历史摘要 · 未重新核验 · NVD

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits ...

CVE-2026-90454

CVE-2026-90454 是一个访问控制绕过漏洞，影响一个捆绑的包分析组件的部署模式。该部署模式的设计意图是仅暴露对组件接口的读取权限，并通过模式匹配的方式拒绝一系列具有写入能力的路由。然而，该模式匹配列表遗漏了用于修改存储在会话记录上

历史摘要 · 未重新核验 · NVD

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application...

CVE-2026-90453

CVE-2026-90453 是一个典型的开放重定向（Open Redirect，CWE-601）类漏洞，存在于某应用的文件上传处理逻辑中。根据 NVD 元数据描述，该文件上传处理程序在完成上传后会向已通过身份验证的客户端浏览器返回一个重定

历史摘要 · 未重新核验 · NVD

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployme...

CVE-2026-90451

CVE-2026-90451 描述的是一类典型的“不安全默认配置/硬编码密钥”缺陷。受影响产品在发布时随附了一份示例环境配置文件（例如示例 .env 或类似的环境变量模板），其中用于对某个内置的数据包分析（packet-analysis）组

历史摘要 · 未重新核验 · NVD

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to...

CVE-2026-90450

该漏洞是应用程序角色授权判定逻辑中的默认放行 (fail-open) 缺陷,属于典型的失效访问控制 (Broken Access Control) 问题。应用程序内部维护了一张「请求处理器名称 → 所需角色」的授权映射表,在收到请求时依据该

历史摘要 · 未重新核验 · NVD

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allo...

CVE-2026-90448

该漏洞存在于一种被设计为『仅暴露存储数据读取能力』的部署模式中。实现该模式时，产品将一组后端 API 路由直接代理给调用方，但只关注了业务语义上的『只读』，并未在传输层对允许的 HTTP 请求方法施加白名单限制。在这批被代理的路由里，有一条

历史摘要 · 未重新核验 · NVD

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any...

CVE-2026-90447

该漏洞属于典型的访问控制失效（Broken Access Control）与认证路径不一致问题。问题根源在于网关/反向代理层的路由规则：同一后端服务配置了两套不同的认证与授权机制，而系统在二者之间进行选择时，依据的是客户端可自行提供的请求头

历史摘要 · 未重新核验 · NVD

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytic...

CVE-2026-90446

CVE-2026-90446 描述的是一类典型的服务端请求路径注入问题，可视为 SSRF 的变体。受影响应用的某个 API 端点会接收用户可控的输入值，并在未做内容校验或白名单限制的情况下，将其直接拼接进发往后端搜索与分析数据存储（如 El

历史摘要 · 未重新核验 · NVD

Empirical Evaluation of Membership Inference Attacks on NLP Text Classifiers: A Baseline Study on SST-2

该论文针对自然语言处理中的训练数据隐私风险，系统评估了成员推断攻击（Membership Inference Attack, MIA）在文本分类任务上的实际威胁。MIA 的目标是判断某条具体记录是否被用于训练某个模型；在 NLP 场景下，训

历史摘要 · 未重新核验 · arXiv cs.CR

Differentially Private Average Treatment Effect Estimation by Propensity Score Blocking

观察性研究中的平均处理效应（ATE）估计是社会科学、医学和流行病学等领域广泛使用的基础统计工具，用于在无法进行随机对照试验时评估某种干预或暴露对结果变量的因果影响。然而这些领域所处理的数据通常包含高度敏感的个人信息，直接发布基于原始数据的

历史摘要 · 未重新核验 · arXiv cs.CR

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intende...

CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without valid

历史摘要 · 未重新核验 · NVD

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs a...

CVE-2026-90444

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shel

历史摘要 · 未重新核验 · NVD

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. Th...

CVE-2026-90443

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate e

历史摘要 · 未重新核验 · NVD

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with ...

CVE-2026-54258

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and

历史摘要 · 未重新核验 · NVD

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary ...

CVE-2026-54248

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and

历史摘要 · 未重新核验 · NVD

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer siz...

CVE-2026-54241

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic

历史摘要 · 未重新核验 · NVD

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stre...

CVE-2026-54240

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic

历史摘要 · 未重新核验 · NVD

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote en...

CVE-2026-50018

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClie

历史摘要 · 未重新核验 · NVD

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map...

CVE-2026-50013

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `Add

历史摘要 · 未重新核验 · NVD

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for ...

CVE-2026-49992

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request for

历史摘要 · 未重新核验 · NVD