NVD disclosure day
CVE-2026-39846
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability in SiYuan's desktop client allows remote code execution when a synced, malicious note is opened, due to unescaped table caption content enabling stored XSS. This could allow unauthorized code execution with system access on a user's machine.
CVE-2026-34580
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A flaw in the Botan cryptography library may allow a malicious certificate to be accepted as trusted if its identifying information matches a trusted root. This bypasses intended validation, potentially compromising system security. Confirming relevance and exposure is necessary.
CVE-2026-34078
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Flatpak allows sandboxed applications to access arbitrary host files by using app-controlled symlinks, potentially leading to code execution. This issue affects Flatpak versions prior to 1.16.4.
CVE-2026-34045
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An unauthenticated HTTP server in Podman Desktop allows network attackers to cause denial-of-service by exhausting system resources, potentially crashing the application or freezing the host. Attackers may also extract sensitive information like internal paths and usernames, which could aid further exploitation. This v
CVE-2025-69515
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An issue affects JXL 9 Inch Car Android Double Din Player systems, enabling attackers to broadcast falsified GPS signals that the infotainment system accepts as legitimate. This could cause the device to report an incorrect or static location, potentially impacting navigation or other location-dependent functions. The
CVE-2026-4631
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Cockpit's remote login feature is vulnerable to unauthenticated code execution. An attacker with network access can send a malicious request to the login endpoint, injecting commands that run on the host before any credentials are checked. This could impact system confidentiality, integrity, and availability. The poten
CVE-2026-23696
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection vulnerability in Windmill's folder ownership management allows authenticated attackers to access sensitive data and execute arbitrary code.
CVE-2026-33816
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An external attacker can target the pgx Go library by sending specially crafted data to applications communicating with a database. This can corrupt memory and trigger repeated system crashes, leading to severe service outages and disrupted operations for all users.
CVE-2026-33815
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An external attacker can send malicious data to applications using the jackc/pgx database library to trigger system crashes. This can result in persistent service outages, taking down critical business functions by disabling database connectivity.
CVE-2026-21413
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A heap-based buffer overflow vulnerability exists in LibRaw's image loading functionality. An attacker can exploit this by providing a specially crafted malicious file, potentially leading to a crash or further compromise. It is important to identify if your organization uses software that depends on this library and i
CVE-2026-20911
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A heap-based buffer overflow vulnerability exists in the LibRaw image processing library's HuffTable::initval functionality. Attackers can exploit this by providing a specially crafted malicious file, potentially leading to disruption of operations if affected applications process untrusted image files. The full impact
CVE-2026-20889
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A heap buffer overflow in LibRaw's x3f_thumb_loader can be triggered by a malicious file, potentially leading to code execution or denial of service. This vulnerability affects systems that use LibRaw for image processing.
CVE-2026-5735
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Memory safety vulnerabilities in Firefox and Thunderbird could allow for arbitrary code execution if exploited. This could impact data integrity and confidentiality for users interacting with malicious content or websites through these applications. Uncertainty exists regarding the specific exploitability and potential
CVE-2026-5734
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Memory safety vulnerabilities in Firefox and Thunderbird could permit arbitrary code execution. These flaws are reachable via network access and may allow attackers to compromise affected systems. Organizations should identify and assess instances of these applications to understand potential impact.
CVE-2026-5731
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Memory safety bugs in certain versions of Firefox and Thunderbird could allow for arbitrary code execution if reachable, impacting user data and application behavior. This vulnerability affects desktop applications and requires user interaction with malicious content to exploit.
CVE-2026-34197
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An internal attacker with administrative credentials could take full control of the Apache ActiveMQ server by running malicious commands. This flaw poses a critical business risk, as it could lead to total system compromise and unauthorized access to sensitive message data.