NVD disclosure day
CVE-2026-34352
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An incorrect permission flaw in TigerVNC's x0vncserver can let unauthorized users view or alter screen content, or crash applications. This exposes organizations to risks of data compromise and system disruption.
CVE-2026-30458
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in FuelCMS allows attackers to exfiltrate password reset tokens through a mail splitting attack. This means sensitive user data could be exposed if the affected software is in use and reachable. Determining if your organization uses this product is the initial concern.
CVE-2026-30457
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in Daylight Studio FuelCMS's Dwoo parser component allows for arbitrary code execution if reachable via network. Attackers can exploit this by sending crafted PHP code, potentially leading to system compromise. The primary concern is determining if your environment uses this software and if it'
CVE-2026-4809
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical flaw in the Laravel-mediable package allows attackers to upload malicious code as images, potentially taking control of your systems if they handle file uploads. There is no patch available, so immediate review is needed for any applications using this package.
CVE-2026-33526
Halo Surface Signal: 3 out of 5 — possibly public-facing.
Squid, a web caching proxy, has a heap Use-After-Free vulnerability in its Internet Cache Protocol (ICP) handling. This could allow a remote attacker to cause a denial of service if ICP is explicitly enabled.