NVD disclosure day
CVE-2025-15031
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in MLflow allows arbitrary file writes due to improper handling of tar archive entries, potentially leading to system compromise. This impacts systems processing untrusted artifacts, particularly in multi-tenant environments.
CVE-2026-25873
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
OmniGen2-RL's reward server has a critical vulnerability allowing unauthenticated remote attackers to execute arbitrary commands via malicious HTTP POST requests exploiting insecure pickle deserialization. This could lead to code execution on the host system. It is important to determine if this technology is used and
CVE-2026-28500
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A security control bypass in the ONNX machine learning library's model loading function allows for silent exfiltration of sensitive files like credentials, posing a risk for supply-chain attacks.