NVD disclosure day
CVE-2026-42880
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An internal attacker with limited access can exploit a flaw in Argo CD to steal sensitive system credentials. This vulnerability could allow them to impersonate trusted accounts and gain unauthorized control over critical cloud infrastructure.
CVE-2026-7891
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Mendix Studio Pro apps can expose sensitive customer data to anyone due to an authorization misconfiguration. This allows anonymous users to access all stored records, even without permissions.
CVE-2026-35435
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical flaw in Microsoft Azure AI Foundry agents lets anyone on the internet take over the service and access sensitive data. This requires immediate attention.
CVE-2026-35428
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical issue in Microsoft Azure Cloud Shell lets attackers impersonate users and control your cloud services. This command injection vulnerability is accessible over the internet and could lead to significant compromise.
CVE-2026-33844
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An internal attacker with existing access to Azure Managed Instance for Apache Cassandra could run unauthorized code. This allows them to change system settings or access sensitive application data, potentially compromising the entire database environment.
CVE-2026-33109
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An internal attacker with network access could exploit a flaw in Azure Managed Instance for Apache Cassandra to run unauthorized commands. This could allow them to take control of the service and potentially gain access to sensitive business data.
CVE-2026-42284
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A critical flaw in GitPython lets attackers run code on your systems when cloning repositories, potentially exposing sensitive data and systems. Update GitPython now to version 3.1.47 or later to stay protected.
CVE-2026-41902
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
FreeScout allows anyone to take over any account if they obtain a leaked invite link because setup links never expire, potentially leading to full system compromise. This issue is patched in version 1.8.217.
CVE-2026-37709
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An external attacker can exploit a flaw in the Snipe-IT asset management system to remotely run unauthorized commands on the server. This could lead to a full compromise of the system and exposure of sensitive corporate asset inventory data.
CVE-2026-7415
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Yarbo lawn mowers can be remotely controlled by anyone on your network due to a security flaw, allowing unauthorized access to robot data and commands.
CVE-2026-7414
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Yarbo firmware uses identical, unchangeable administrative passwords that allow an external attacker to bypass security and gain management access. This enables full administrative control over the device, risking unauthorized configuration changes and the theft of sensitive data.
CVE-2026-7413
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A hidden backdoor in Yarbo firmware allows an external attacker to bypass security measures and take full control of the device over the internet. This creates a severe business risk, as the flaw is persistent and could allow unauthorized parties to establish permanent, undetected access to your infrastructure.
CVE-2026-7821
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Ivanti EPMM has a critical flaw allowing remote attackers to enroll devices, potentially exposing sensitive information and compromising device identities. This requires immediate attention as it affects device management security.
CVE-2026-6973
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical flaw in Ivanti EPMM lets authenticated administrators run malicious code on your systems, potentially allowing attackers to take control of managed devices. This requires your immediate attention.
CVE-2026-5788
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Ivanti EPMM has a critical flaw that lets attackers remotely control your systems and data without needing any login. This is urgent because it could expose your organization to significant risks.
CVE-2026-5787
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An attacker can impersonate Ivanti EPMM servers to steal legitimate client certificates, potentially compromising sensitive data and mobile device management. This is a critical vulnerability due to its internet-facing exposure and unauthenticated remote attack possibility.
CVE-2025-63704
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The NPM package query-string-parser has a critical flaw that lets attackers corrupt data or take control of your application by manipulating web requests. Address this now to prevent potential system compromise.
CVE-2025-63703
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An external attacker can exploit the parse-ini library to manipulate application data and behavior, potentially bypassing security controls to gain unauthorized access. This could lead to sensitive information exposure or unauthorized changes to core business functions.
CVE-2026-42011
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An external attacker can impersonate trusted services by bypassing security checks with fake certificates. This could lead to the exposure of sensitive credentials, impacting business operations and trust.
CVE-2026-36458
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An internal attacker with administrative access to ChestnutCMS can exploit a system flaw to run unauthorized database commands. This enables them to steal sensitive business information, such as user credentials and site configuration data.
CVE-2025-63706
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
The next-npm-version package contains a flaw that allows an external attacker to execute unauthorized commands on host servers. This exposure could grant the attacker access to sensitive environment variables, proprietary source code, or control over the application environment.
CVE-2026-6795
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An external attacker can exploit a flaw in DivvyDrive to redirect users to malicious websites, increasing the success of phishing campaigns. This facilitates the theft of sensitive user credentials and session tokens, which could lead to unauthorized access to company accounts.
CVE-2026-41589
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical flaw in the Wish SSH server lets attackers read or write any file, potentially exposing sensitive data or letting them alter systems. This needs immediate attention because SSH servers are often internet-facing.
CVE-2026-30496
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An internal attacker on the local network can gain full remote control over the Optoma CinemaX P2 projector due to missing security checks. This could allow unauthorized changes to projector settings and enable further access into your network, potentially disrupting business operations.
CVE-2026-8094
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An external attacker can exploit a vulnerability in the Firefox ESR and Thunderbird media processing component to take control of a user's browser. This could allow them to steal sensitive data or install malicious software, posing a risk to both user workstations and company information.
CVE-2026-8091
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical flaw in Firefox and Thunderbird allows attackers to run malicious code on your computer through audio or video playback, potentially leading to system takeover. Update now to protect your data and services.
CVE-2026-6508
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An internal attacker could exploit a flaw in Liderahenk to bypass security checks and access restricted management functions. This allows them to manipulate system configurations, potentially resulting in full administrative control over connected infrastructure.
CVE-2026-42010
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An external attacker can bypass login security in GnuTLS software by using specially crafted usernames. This flaw allows unauthorized access to sensitive company data and protected services.
CVE-2025-1978
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An external attacker could exploit a flaw in Hitachi Storage Navigator to gain control of critical storage systems, potentially resulting in data loss or operational disruption. This vulnerability allows unauthorized commands to be run on the hardware, creating a significant risk to business operations.
CVE-2025-9661
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical flaw in Hitachi Virtual Storage Platform One Block allows unauthorized users to run commands, potentially giving attackers full control over your company's sensitive data.
CVE-2026-41586
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An internal attacker can exploit a flaw in Hyperledger Fabric to gain administrative control over the platform. This creates a severe business risk, as it allows unauthorized access to sensitive data and could lead to the compromise of ledger integrity or total operational failure.
CVE-2026-44603
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Tor has a critical flaw that could crash it or expose sensitive data, affecting anyone using it for anonymity and requiring immediate attention to update the software.
CVE-2026-41203
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An internal attacker with theme management permissions can exploit a file upload flaw in CI4MS to place malicious code on the server. This could allow them to gain full control of the application and access sensitive system areas.
CVE-2026-41202
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An internal attacker with access to CI4MS backup tools could upload malicious files to take full control of the server. This allows unauthorized command execution and could lead to a complete system compromise.
CVE-2026-41201
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An attacker can fully take over accounts and gain admin control in CI4MS by tricking users with malicious backup filenames, potentially exposing sensitive data. A patch is available.
CVE-2026-40982
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An issue in Spring Cloud Config allows an external attacker to read private server files. This flaw could expose sensitive credentials or API keys, potentially enabling unauthorized access to our backend services.
CVE-2026-44597
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A flaw in Tor could let attackers disrupt services or access sensitive data by sending malformed network messages. This issue is particularly concerning because Tor relays are designed to be accessible from the internet.