CWE-522 不充分的凭证保护机制 类弱点 526 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-522属于凭据保护不足漏洞，指产品在传输或存储认证凭据时使用了不安全的方法，易导致凭据被未授权方拦截或窃取。攻击者通常通过中间人攻击、网络嗅探或访问未加密的存储介质来获取敏感信息，进而冒充合法用户。开发者应避免使用明文传输，采用TLS等加密协议保护传输过程，并在存储时使用强哈希算法加盐处理，确保凭据机密性与完整性。
$user = $_GET['user']; $pass = $_GET['pass']; $checkpass = $_GET['checkpass']; if ($pass == $checkpass) { SetUserPassword($user, $pass); }... Properties prop = new Properties(); prop.load(new FileInputStream("config.properties")); String password = prop.getProperty("password"); DriverManager.getConnection(url, usr, password); ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-93474 | Monta 应用凭证保护不足漏洞 — monta.app | 6.5 | Medium | 2026-10-02 |
| CVE-2026-104051 | PictShare <3.7.1 信息泄露漏洞 — pictshare | 8.2 | High | 2026-10-01 |
| CVE-2026-103256 | n8n 2.39.6前凭据泄露漏洞 — n8n | 7.1 | High | 2026-10-01 |
| CVE-2026-92537 | Newsletter 9.3.9 凭据保护不足漏洞 — Newsletter – Send awesome emails from WordPress | 5.3 | Medium | 2026-10-01 |
| CVE-2026-100264 | JetBrains YouTrack 2026.2前SMTP凭据泄露漏洞 — YouTrack | 2.7 | Low | 2026-09-30 |
| CVE-2026-100298 | Anjvision YSSD-RTMP-H5 凭据保护不足漏洞 — YSSD-RTMP-H5 | 8.8 | High | 2026-09-29 |
| CVE-2026-81930 | Apache Airflow Snowflake provider 令牌重定向漏洞 — Apache Airflow Snowflake provider | - | - | 2026-09-29 |
| CVE-2026-101089 | 哪吒监控 2.2.7 之前信息泄露漏洞 — nezha | 3.1 | Low | 2026-09-27 |
| CVE-2026-100569 | OpenClaw 凭证泄露漏洞（Endpoint覆盖） — OpenClaw | 5.5 | Medium | 2026-09-26 |
| CVE-2026-92680 | Araxis Merge 凭证保护不足漏洞 — Merge | 5.5 | Medium | 2026-09-24 |
| CVE-2026-81208 | Cloud Pak for Data DataStage 多个漏洞 — DataStage on Cloud Pak for Data | 7.7 | High | 2026-09-23 |
| CVE-2026-18124 | IBM FTM 多个安全漏洞 — Financial Transaction Manager (FTM) for RedHat OpenShift | 6.5 | Medium | 2026-09-22 |
| CVE-2026-17643 | IBM FTM 多漏洞 — Financial Transaction Manager (FTM) for RedHat OpenShift | 8.8 | High | 2026-09-22 |
| CVE-2026-92882 | Redact REST API主机配置响应泄露SNMP凭据漏洞 — Checkmk | 2.3 | Low | 2026-09-22 |
| CVE-2026-48976 | HomeBox 通知器更新 IDOR 泄露凭证漏洞 — homebox | 8.1 | High | 2026-09-21 |
| CVE-2026-89064 | WP迁移备份7.110凭证保护不足漏洞 — All-in-One WP Migration and Backup | 5.3 | Medium | 2026-09-17 |
| CVE-2026-92759 | SecObserve 1.59.1 前 API 配置信息泄露漏洞 — SecObserve | 6.5 | Medium | 2026-09-16 |
| CVE-2026-20234 | Cisco ISE 凭据保护不足漏洞 — Cisco Identity Services Engine Software | 9.9 | Critical | 2026-09-16 |
| CVE-2026-92256 | Netcore NR255-V 1.5.130703 IPsec密钥泄露漏洞 — NR255-V | 6.5 | Medium | 2026-09-15 |
| CVE-2026-76871 | Netcore NR255-V 信任管理问题漏洞 — NR255-V | 6.5 | Medium | 2026-09-15 |
| CVE-2026-76859 | Netcore NR255-V 信任管理问题漏洞 — NR255-V | 6.5 | Medium | 2026-09-15 |
| CVE-2026-76857 | Netcore NR255-V 信任管理问题漏洞 — NR255-V | 6.5 | Medium | 2026-09-15 |
| CVE-2026-76854 | Netcore NR255-V 信任管理问题漏洞 — NR255-V | 6.5 | Medium | 2026-09-15 |
| CVE-2026-11921 | IBM Security Verify Access 安全漏洞 — Verify Identity Access | - | - | 2026-09-15 |
| CVE-2026-91982 | Vikunja 信任管理问题漏洞 — vikunja | 4.3 | Medium | 2026-09-15 |
| CVE-2026-82433 | Apache Storm Nimbus 信任管理问题漏洞 — Apache Storm Nimbus | - | - | 2026-09-14 |
| CVE-2026-82434 | Apache Storm Nimbus 信任管理问题漏洞 — Apache Storm Nimbus | 10.0 | Critical | 2026-09-14 |
| CVE-2026-84179 | Apache Storm Nimbus 信息泄露漏洞 — Apache Storm Nimbus | - | - | 2026-09-14 |
| CVE-2026-75015 | Apache Syncope 信任管理问题漏洞 — Apache Syncope | - | - | 2026-09-14 |
| CVE-2026-82786 | Contec CONPROSYS nano Series 信任管理问题漏洞 — Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* | 6.3 | Medium | 2026-09-14 |
CWE-522（不充分的凭证保护机制） 是常见的弱点类别，本平台收录该类弱点关联的 526 条 CVE 漏洞。