NVD disclosure day
CVE-2026-25608
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
STER applications send data without encryption, risking sensitive information like passwords being stolen via network interception. This advisory warrants attention due to the potential exposure of critical user data.
CVE-2026-25607
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
STER software has a weakness that allows an internal attacker to decipher stored user passwords. This could lead to unauthorized access to sensitive business data and grant the attacker administrative control over the platform.
CVE-2026-25606
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An internal attacker with legitimate access can exploit search filters in STER to bypass security controls and retrieve private information belonging to other users. This exposes the business to potential widespread theft of sensitive organizational and customer data.
CVE-2026-9011
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
WordPress Ditty plugin versions prior to 3.1.66 allow anyone to view private drafts and scheduled posts, potentially exposing sensitive information from your website.
CVE-2026-8692
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A WordPress form plugin called Vedrixa Forms allows authenticated users to change any form's structure, potentially impacting data collection and site integrity. This warrants attention now due to the ease with which basic users can exploit it.
CVE-2026-8684
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The MotoPress Hotel Booking plugin for WordPress has a flaw allowing anyone to alter or delete internal booking notes without logging in, impacting business data on public-facing websites.
CVE-2026-8679
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
The AudioIgniter WordPress plugin can expose private playlist details, like song titles and download links, to anyone on the internet. This could help attackers gather information about your site's content.
CVE-2026-8381
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An internal attacker with low-level access can bypass security controls within the TeamViewer DEX Platform to run restricted commands. This allows them to take full control of the management software, risking unauthorized access to sensitive company data and critical IT infrastructure.
CVE-2026-7798
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The FluentCRM WordPress plugin has a vulnerability allowing unauthenticated attackers to make your website request other systems, potentially exposing internal information if certain email settings are not configured.
CVE-2026-7636
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The Slider by Soliloquy WordPress plugin can expose draft content and unpublished media URLs to authenticated users, potentially revealing information before it's meant to be public.
CVE-2026-7615
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A WordPress plugin lets attackers trick administrators into changing widget settings, potentially altering your site's appearance without proper authorization. Update the Widget Context plugin now.
CVE-2026-9104
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An external attacker with WordPress author access can inject scripts into draft post titles, which run when others view the page, potentially stealing session cookies or redirecting users to phishing sites. This can lead to unauthorized access to user accounts.
CVE-2026-9018
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A flaw in the Easy Elements for Elementor WordPress plugin could let anyone with a new account become an administrator. This is critical for sites with user registration enabled and a public login widget.
CVE-2026-7509
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An internal attacker can inject malicious scripts into WordPress pages using the KIA Subtitle plugin, potentially hijacking user sessions or stealing credentials. This matters because it allows unauthorized script execution in users' browsers.
CVE-2026-7249
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The Location Weather WordPress plugin has a flaw allowing users with contributor access to disable weather features and clear cached data, impacting website content.
CVE-2026-6864
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A security flaw in the WordPress CBX 5 Star Rating & Review plugin could let attackers run malicious scripts in your admin's browser if they click a bad link, potentially impacting your site.
CVE-2026-4070
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A security flaw in the Alfie WordPress plugin allows attackers to delete your data if an administrator clicks a malicious link. This could lead to significant data loss on your website.
CVE-2026-9054
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An external attacker can send malicious network traffic to the 9front operating system to trigger a total system crash. This vulnerability poses a significant risk to operations by allowing the attacker to cause repeated service outages, resulting in system downtime and a loss of user access.
CVE-2026-4834
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A serious flaw in the WP ERP Pro plugin for WordPress could allow attackers to steal sensitive data from your website, even without a login. Update immediately to protect your information.
CVE-2026-39831
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in a cryptographic library could allow signatures from security keys to be accepted without user presence. This could impact systems relying on these keys for authentication, potentially leading to unauthorized access. Organizations should identify affected systems and apply vendor-provided fixes.
CVE-2026-39830
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A flaw in the Go crypto library can disrupt SSH connections by filling an internal buffer with unsolicited responses, leading to resource leaks. Affected organizations may experience a degradation in service availability. Addressing this vulnerability is recommended to maintain system stability.
CVE-2026-34911
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in UniFi OS devices could allow unauthorized access to system files, potentially exposing sensitive information. This risk matters to organizations because an attacker with low-level network access could exploit this flaw. The realistic business risk involves the compromise of confidential data.
CVE-2026-34910
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An internal attacker on your local network could exploit a flaw in UniFi OS devices to run unauthorized commands. This could allow them to gain full administrative control over your network hardware, potentially compromising your organization's entire network gateway.
CVE-2026-34909
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An internal attacker with network access could exploit a flaw in UniFi OS to read sensitive system files and gain administrative control over the device. This poses a risk to our network infrastructure by potentially exposing critical credentials and allowing unauthorized access to sensitive configurations.
CVE-2026-34908
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An internal attacker with access to your network can bypass security controls in UniFi OS devices to change system configurations without permission. This could allow them to alter firewall rules or user access, potentially giving them full control over your network and disrupting critical business services.
CVE-2026-33000
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An internal attacker with high-level access to UniFi OS devices can misuse input features to run unauthorized commands. This could allow them to gain total control over critical network infrastructure and install persistent access.