PT-2026-93931

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.5.0 through 2.11.0 Description Certain REST API methods used for replacing Process Group contents, versioned flow updates, and rebase operations lack sufficient authorization checks. While asynchronous update methods...

CVE-2026-68979 Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

Beyond Training-Time Poisoning: Component-Level and Post-Training Backdoors in Deep Reinforcement Learning

Deep Reinforcement Learning DRL systems are increasingly used in safety-critical applications, yet their security remains severely underexplored. This work investigates backdoor attacks, which implant hidden triggers that cause malicious actions only when specific inputs appear in the observation...