NVD disclosure day
CVE-2026-33186
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The gRPC-Go library has an authorization bypass vulnerability due to improper validation of the HTTP/2 `:path` pseudo-header. Attackers can exploit this by sending malformed paths to bypass authorization policies on servers with specific deny rules and a fallback allow rule, potentially leading to unauthorized access.
CVE-2026-29796
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical flaw in igl's eparking.fi software allows anyone to impersonate electric vehicle charging stations and control them remotely, potentially disrupting operations and corrupting data across the network.
CVE-2026-33017
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Langflow versions before 1.9.0 allow unauthenticated users to run malicious code on your server by exploiting a public workflow building feature. Update immediately to prevent system compromise.