NVD disclosure day
CVE-2026-3910
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An external attacker can compromise Google Chrome and Chromium-based browsers by luring users to a malicious website. This vulnerability allows the attacker to run unauthorized code on user devices, potentially leading to credential theft and unauthorized access to sensitive company data.
CVE-2026-3909
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An external attacker can compromise a computer and access sensitive data by tricking a user into visiting a malicious website in Google Chrome. This could allow them to run unauthorized code, leading to a full system compromise.
CVE-2026-32306
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
OneUptime, a service monitoring solution, has a critical SQL injection vulnerability in its telemetry aggregation API that allows authenticated users to read, modify, or execute commands within the ClickHouse database. This could expose telemetry data from all tenants and potentially lead to system compromise. OneUptim
CVE-2026-32304
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability in the Locutus JavaScript library allows for arbitrary code execution due to unsanitized parameters passed to its `create_function` feature. This could permit attackers to run malicious code if the library is used in an application. Technical readers and security-aware leaders should confirm re
CVE-2026-31806
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability in FreeRDP, a Remote Desktop Protocol implementation, allows a malicious RDP server to send crafted commands that may cause a heap buffer overflow, potentially overwriting adjacent memory. This could affect the stability or security of the FreeRDP client. Uncertainty exists regarding how FreeRDP is depl