NVD disclosure day

Published threat advisories for January 5, 2026

CVE-2025-68428

jsPDF Node.js Local File Inclusion Vulnerability

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

A vulnerability in the Node.js build of the jsPDF library could allow unauthorized access to arbitrary local files, embedding their contents into generated PDFs. This occurs when unsanitized user input is passed to specific library methods. Reader's should care if they use this library and if the vulnerable functionali

NVD modified: NVD date unavailable

CVE advisoryKnown Exploit

CVE-2025-66376

Zimbra Collaboration Cross-Site Scripting Vulnerability

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

A cross-site scripting vulnerability in Zimbra Collaboration Suite's Classic UI allows attackers to inject malicious code via specially crafted HTML emails, potentially leading to unauthorized data access and system manipulation. This impacts organizations by creating a risk to data integrity and user privacy. Affected

NVD modified: NVD date unavailable • CISA KEV