Search: management.as

CJIS v6.1 compliance mandates agencies to implement strong authentication, account security, and audit controls. Specops highlights five practical priorities for agencies to focus on: multi-factor authentication (MFA), account management, password policies, logging, and audit readiness. This content is an informational overview about compliance priorities rather than a specific vulnerability or exploit.

CVE-2026-105312 is a critical vulnerability in Red Hat StreamsHub Console for Apache Kafka® that allows a Kubernetes tenant with create permission on Console custom resources to deploy arbitrary container images. This leads to privilege escalation by granting cluster-wide read and write access to Strimzi control-plane resources through a pod running with a highly privileged ServiceAccount. The vulnerability affects versions >=0.2.0 <0.12.10 and >=0.13.0 <0.14.2 and is fixed in versions 0.12.10 and 0.14.2.

CVE-2026-113495 is a vulnerability in cockpit-machines on Red Hat Enterprise Linux 10 where Red Hat Subscription Management (RHSM) authentication tokens are exposed as command-line arguments to background helper processes during image retrieval. This allows a local, unprivileged attacker with permission to inspect other users' processes to view these tokens while the process is active, potentially leading to unauthorized access to RHSM resources within the token's validity period. No official fix or mitigation meeting Red Hat's criteria is currently available.

CVE-2026-92287 is a vulnerability in Apache Arrow's C++ Parquet and PyArrow libraries from versions 4.0.0 to 25.0.1. It involves the pass-through of unvalidated Key Management Service (KMS) URLs to KMS clients when reading Parquet files with decryption properties configured. If the KMS URL is file-controlled and the KMS client does not validate the URL, a KMS token could be sent to an attacker-controlled host. Version 26.0.0 addresses this by disabling this behavior by default and requiring explicit opt-in via a configuration flag.

A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.

CVE-2026-86868 is a critical authentication vulnerability in macOS that allows an attacker to impersonate other users due to improper state management. The issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

An authorization issue was addressed with improved state management. This issue is fixed in visionOS 27. An app may be able to access sensitive user data.

This vulnerability involves the WiFi driver component 'wfx' in Microsoft software, where the MIB (Management Information Base) read length is not properly validated before copying data to the caller. The flaw could potentially lead to improper memory handling. The affected versions explicitly include 3.0 and 4.0. No CVSS score or detailed impact information is provided, and there is no indication of exploitation in the wild or available patches.

A vulnerability identified as CVE-2026-98529 affects Microsoft software versions 3.0 and 4.0. It relates to a runtime power management leak in the arizona_gpio_direction_out() function within the gpio: arizona component. No CVSS score or detailed impact information is provided.

This vulnerability involves the iio: proximity: pulsedlight component where the iio_device remains registered after a power management setup failure. It affects Microsoft products with versions 3.0 and 4.0. No CVSS score or detailed impact information is provided.

CVE-2026-98465 concerns a vulnerability in the RISC-V KVM implementation related to the serialization of IMSIC attributes during vCPU migration. The issue involves the handling of IMSIC attributes, which are critical for interrupt management in virtualized environments. The vulnerability affects Microsoft products with versions 3.0 and 4.0. No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild.

CVE-2026-86976 is an authorization vulnerability in Apple iOS and iPadOS that could allow an app to access sensitive user data. The issue was addressed by improved state management and fixed in iOS 27 and iPadOS 27. This vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-86962 is a double free vulnerability in Apple iOS and iPadOS that may allow an app to cause unexpected system termination. The issue affects multiple Apple operating systems and was addressed by improved memory management. Fixed versions include iOS 26.7 and later, iPadOS 26.7 and later, and macOS 15.8 and later.

CVE-2026-86955 is an authorization vulnerability in Apple iOS and iPadOS that could allow an app to access sensitive user data. The issue was addressed by improving state management and is fixed in iOS and iPadOS version 27.

CVE-2026-86932 is a vulnerability in Apple macOS where an authorization issue could allow an app to access sensitive user data. The flaw was addressed by improved state management and fixed in macOS Golden Gate version 27. The vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-86922 is a high-severity type confusion vulnerability in Apple Safari that could allow arbitrary code execution when processing maliciously crafted web content. The issue was addressed by improved state management and is fixed in Safari 27 and corresponding OS versions. Versions of Safari prior to 27 are affected.

CVE-2026-86914 is an information disclosure vulnerability in Apple macOS that could allow an app to access sensitive network connection information. The issue was addressed by improved state management and is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

CVE-2026-86913 is a use-after-free vulnerability in Apple operating systems including iOS, iPadOS, and macOS. It occurs when processing a maliciously crafted media file, potentially causing unexpected app termination or corruption of process memory. The issue has been addressed with improved memory management and fixed in iOS and iPadOS 26.7 and 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.

CVE-2026-86872 is a logic flaw in Apple Safari that could cause unexpected behavior when processing maliciously crafted web content. The issue was addressed by improving state management and is fixed in Safari version 27. This vulnerability has a medium severity rating with a CVSS score of 5.4.