NVD disclosure day

Published threat advisories for January 9, 2026

CVE-2025-13761

GitLab Unauthenticated Code Execution via Crafted Webpage in Browser

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical vulnerability in GitLab allows unauthenticated users to execute arbitrary code in a user's browser if that user visits a specially crafted webpage. This could impact the confidentiality, integrity, and availability of the system.

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2025-70974

Fastjson AutoType JNDI Injection Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical vulnerability in Fastjson, a Java library, may allow remote code execution via JNDI injection when processing specific JSON documents. This issue has been actively exploited since 2023. Applications parsing unauthenticated JSON input using this library may be exposed.

NVD modified: NVD date unavailable