NVD disclosure day
CVE-2026-35408
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Directus login pages are vulnerable to a cross-origin manipulation that can hijack the Single Sign-On (SSO) OAuth authorization flow. Attackers can exploit this to redirect users to malicious sites, causing them to unknowingly grant access to their authentication provider accounts. This impacts systems where Directus h
CVE-2026-35459
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
pyLoad, a Python-based download manager, contains a server-side request forgery vulnerability that an authenticated user can exploit by submitting a URL that redirects to an internal address. This occurs because the software automatically follows HTTP redirects without validating the redirect targets against security f
CVE-2026-35197
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in the dye color library, a component for shell scripts, allows arbitrary code execution via specific template expressions. This could impact systems processing untrusted input through scripts, though its typical use suggests limited direct external exposure. The issue is fixed in version 1.1.1 and is n
CVE-2026-35178
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical remote code execution vulnerability exists in the Salesforce Workbench tool due to unsafe processing of attacker-controlled cookie values in its timezone conversion flow, potentially impacting system data and service behavior. This issue affects versions prior to 65.0.0 and requires confirmation of Workbench
CVE-2025-54328
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A stack-based buffer overflow vulnerability in Samsung Exynos processors, impacting mobile and modem firmware, can be triggered by specially crafted SMS messages. This could lead to a compromise of device confidentiality, integrity, and availability. The vulnerability is reachable via the network without authentication
CVE-2025-58349
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An issue in Samsung Exynos mobile, wearable, and modem processors allows for baseband crashes due to incorrect handling of LTE MAC packets. This could disrupt device communication, and its broad impact necessitates an assessment of relevance to your device ecosystem.
CVE-2026-35171
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Kedro, a data science toolbox, has a critical vulnerability allowing attackers to execute arbitrary system commands during application startup by manipulating an unvalidated logging configuration file via an environment variable. This impacts the integrity and availability of systems using Kedro. Confirming Kedro's pre
CVE-2026-35030
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in LiteLLM, an AI gateway, could allow an unauthenticated attacker to impersonate legitimate users by exploiting a JWT authentication cache mechanism. This affects deployments where JWT/OIDC authentication is specifically enabled, potentially leading to unauthorized access to user identities and permiss
CVE-2026-34977
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in Aperi'Solve, an open-source steganalysis web platform, allows unauthenticated attackers to achieve root-level command execution in the worker container via a single HTTP request. This could result in unauthorized access and modification of user-uploaded images, analysis results, and password
CVE-2026-31405
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An external attacker can exploit a vulnerability in Linux systems by sending malicious network data. This can crash servers to cause major service outages, or potentially allow them to gain complete control of the affected systems.