Search: management.as

CVE-2026-86955 is an authorization vulnerability in Apple iOS and iPadOS that could allow an app to access sensitive user data. The issue was addressed by improving state management and is fixed in iOS and iPadOS version 27.

CVE-2026-86932 is a vulnerability in Apple macOS where an authorization issue could allow an app to access sensitive user data. The flaw was addressed by improved state management and fixed in macOS Golden Gate version 27. The vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-86922 is a high-severity type confusion vulnerability in Apple Safari that could allow arbitrary code execution when processing maliciously crafted web content. The issue was addressed by improved state management and is fixed in Safari 27 and corresponding OS versions. Versions of Safari prior to 27 are affected.

CVE-2026-86914 is an information disclosure vulnerability in Apple macOS that could allow an app to access sensitive network connection information. The issue was addressed by improved state management and is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

CVE-2026-86913 is a use-after-free vulnerability in Apple operating systems including iOS, iPadOS, and macOS. It occurs when processing a maliciously crafted media file, potentially causing unexpected app termination or corruption of process memory. The issue has been addressed with improved memory management and fixed in iOS and iPadOS 26.7 and 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.

CVE-2026-86872 is a logic flaw in Apple Safari that could cause unexpected behavior when processing maliciously crafted web content. The issue was addressed by improving state management and is fixed in Safari version 27. This vulnerability has a medium severity rating with a CVSS score of 5.4.

An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker may be able to impersonate other users.

CVE-2026-84490 is a vulnerability in iOS and iPadOS where an attacker with physical access to a locked device could bypass Digital ID authentication if iPhone Mirroring is active. This issue has been addressed with improved state management and is fixed in iOS and iPadOS version 27.

CVE-2026-28850 is an authorization vulnerability in Apple macOS that could allow an app to access sensitive user data. The issue was addressed by improved state management and is fixed in macOS Sequoia 15.8 and visionOS 27. The vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-105453 is a high-severity vulnerability in IBM Sterling Connect Direct for Unix versions 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6. It involves improper privilege management that could allow a local attacker to gain elevated privileges. The vulnerability does not require user interaction and has a low attack complexity. Confidentiality and integrity impacts are high, while availability is not affected.

CVE-2026-112252 is a SQL injection vulnerability in Wuxi Wubang Security Software's Wubang Five-in-One Safety Production Management Information System versions 3.0 through 3.5. The flaw exists in the xp_cmdshell function of the /ws.asmx file, allowing remote attackers to manipulate the sql argument to perform SQL injection. The vulnerability has been publicly disclosed, but the vendor has not responded or issued a patch. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.

Slims (Senayan Library Management Systems) version 9 Bulian 9.8.0 is vulnerable to a cross-site request forgery (CSRF) attack targeting the admin/modules/circulation/loan_history_maintenance.php endpoint. The vulnerability arises because the action=run GET parameter triggers privileged and destructive operations without requiring a CSRF token or POST confirmation. This flaw can lead to unauthorized deletion of loan history records, resulting in data loss.

Bulletin ID: 2026-052-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/06/2026 13:45 PM PDT Description: Amazon mcp-gateway-registry is an open-source gateway and registry for Model Context Protocol (MCP) servers, providing centralized discovery, authentication/authorization, and proxying of MCP tools for AI agents. We identified CVE-2026-14471, an issue in the metrics-service retention policy management component where a caller-supplied table_name value is interpolated into SQL statements in identifier position without proper neutralization. An authenticated remote user is able to supply a crafted table_name value to execute arbitrary SQL queries against the metrics database. This allows the user to read stored data (including API key material) and to delete or alter stored data. Impacted versions: >=1.0.3 AND <=1.0.12 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CVE-2026-112247 is a cross-site scripting (XSS) vulnerability in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System versions 3.0 through 3.5. The flaw exists in the Upload Endpoint component, specifically in the /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx file, where manipulation of the NewFile argument can lead to XSS. The vulnerability can be exploited remotely and public exploit code is available. The vendor has not responded to disclosure attempts.

WSO2 Universal Gateway versions prior to specific fixed releases expose sensitive credentials such as remote log server credentials, truststore passwords, and keystore passwords in cleartext within the Management Console and product files. This vulnerability arises because the system does not adequately protect these credentials when the remote logging feature is enabled. An attacker with administrative or direct file access can retrieve these credentials, potentially compromising the confidentiality and integrity of the remote log server.

This content discusses cybersecurity challenges faced by small and medium-sized businesses (SMBs), focusing on vulnerabilities in people, processes, and technology that can lead to cyberattacks. It highlights how attackers exploit gaps such as unpatched software, insufficient employee training, and inadequate protection of cloud infrastructure. A real-world case study describes an ERP system breach during cloud migration, where attackers used phishing and exploited unpatched vulnerabilities to gain administrator access and steal confidential data. The article emphasizes the importance of targeted employee training, structured patch management, and appropriate technological defenses to mitigate risks.

A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-112151 is a SQL injection vulnerability in the vraj404 Criminal Management System affecting an unknown functionality in the home.php file's Submission Form component. The vulnerability allows remote attackers to manipulate multiple parameters (id, name, offName, crime, dob, arrDate, crimeDate, sex, address, folder, more) to execute SQL injection attacks. Exploit code is publicly available. Due to the product's rolling release strategy, specific affected or fixed versions are not provided.