NVD disclosure day
CVE-2026-24423
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated remote code execution vulnerability exists in SmarterMail's ConnectToHub API. Attackers can direct the application to a malicious server, leading to the execution of operating system commands. This impacts organizations by potentially compromising systems and data.
CVE-2025-4320
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in Sufirmam software allows attackers to bypass authentication and recover user passwords through a weak recovery mechanism. This could lead to unauthorized account access and control if the software is reachable. The vendor has not responded to the disclosure of this critical issue.
CVE-2025-4319
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in Sufirmam's authentication and password recovery mechanisms allows for brute-force attacks and password exploitation. This could lead to unauthorized access to user accounts and potentially sensitive information when the system is reachable over a network. The vendor has not responded to inqu