NVD disclosure day
CVE-2026-44566
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An internal attacker can manipulate file uploads in Open WebUI to save malicious files to restricted system locations. This could allow them to override critical settings or run unauthorized code, leading to a complete compromise of the platform.
CVE-2026-44551
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An external attacker can bypass login on the Open WebUI platform by submitting an empty password. This allows unauthorized access to user accounts, which could expose sensitive chat history and internal system settings.
CVE-2026-46364
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
phpMyFAQ's public API is vulnerable to SQL injection, potentially exposing sensitive customer data like credentials to unauthenticated attackers. This advisory deserves attention now due to the direct exposure of customer data and ease of exploitation.
CVE-2026-45010
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
phpMyFAQ's admin login can be bypassed by guessing a six-digit code, giving anyone full control of your knowledge base. Update to version 4.1.2 or later immediately.
CVE-2021-47965
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
WordPress plugin WP Super Edit has a critical flaw allowing attackers to upload harmful files, potentially giving them full control of your website. This issue is accessible from the internet and needs immediate attention.
CVE-2026-45035
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Tabby contains a flaw that allows an external attacker to compromise a user’s computer through a malicious link. If clicked, the attacker can run unauthorized commands, potentially leading to the theft of sensitive local files or complete control of the workstation.
CVE-2026-44717
Halo Surface Signal: 3 out of 5 — possibly public-facing.
MCP Calculate Server contains a vulnerability that allows an external attacker to run malicious commands on the server by sending crafted mathematical queries. This could lead to a full system compromise, granting the attacker control over the server and unauthorized access to business data.
CVE-2026-44699
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
LibJWT can be tricked into accepting fake tokens, allowing attackers to bypass security on internet-facing applications without needing any secret keys.
CVE-2026-42155
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A security flaw in Magento LTS allows attackers to easily hijack active sessions, potentially accessing sensitive customer data or disrupting your online store. This is a critical vulnerability affecting internet-facing APIs.
CVE-2026-41258
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An internal attacker with specific administrative privileges could exploit a vulnerability in OpenMRS to run unauthorized code. This could allow them to gain full system control and access sensitive patient data, creating a severe risk to data privacy and platform integrity.
CVE-2026-2031
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Google Cloud Application Integration has a critical flaw allowing unauthenticated attackers to steal sensitive data and run code remotely by exploiting exposed internal APIs.
CVE-2026-7182
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Diagram's export feature allows anyone to access local server files by sending a specially crafted message. This could lead to sensitive information being included in generated PDFs.
CVE-2026-41553
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
DHTMLX PDF Export Module flaws let anyone gain control of your servers by sending a malicious link. This critical issue impacts DHTMLX Gantt and Scheduler products.
CVE-2026-41552
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
DHTMLX Gantt and Scheduler products have a flaw that lets anyone view local files from the server within exported PDFs. Update the PDF Export Module to 0.7.6 to fix this information leak.
CVE-2026-8398
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Official DAEMON Tools Lite installation packages were compromised through a supply chain attack, embedding trojanized binaries signed with legitimate certificates. This allows malicious code to appear trustworthy, potentially leading to unauthorized system access and control when users install the affected software. It
CVE-2026-5229
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical flaw in the WordPress Form Notify plugin lets anyone steal any account, even administrator ones, by tricking the login process. This impacts widely used websites and requires immediate attention.
CVE-2026-0481
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An external attacker can modify GPU configurations in the AMD Device Metrics Exporter. This allows them to disable device features, which could cause outages for GPU-dependent applications and disrupt critical computing workloads.