NVD disclosure day
CVE-2026-48027
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A malicious version of Nx Console was briefly available, containing code that could harvest credentials. Organizations using the affected version could experience unauthorized access to sensitive information. Upgrading to a non-compromised version mitigates this risk.
CVE-2025-70103
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A heap buffer overflow vulnerability in the libjxl library could permit attackers to access or alter data by providing specially crafted PBM images. This poses a business risk to organizations relying on the library for image processing, potentially leading to service disruption or data compromise.
CVE-2026-8175
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A buffer overflow vulnerability in IBM Aspera's network transfer component could allow unauthenticated attackers to cause denial of service, bypass authentication, or execute remote code, impacting service availability and integrity.
CVE-2026-7524
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
IBM Langflow OSS versions 1.0.0 through 1.9.1 have a remote code execution flaw due to improper symbolic link validation during archive extraction. This could allow an attacker to execute unauthorized code on affected systems, creating a significant business risk.
CVE-2025-12686
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A buffer overflow vulnerability in Synology BeeStation OS allows remote attackers to execute arbitrary code. This could lead to unauthorized access and potential data compromise for affected organizations. The realistic business risk involves a breach of system integrity and confidentiality.
CVE-2026-9312
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A server-side request forgery vulnerability in GitHub Enterprise Server allows unauthenticated attackers to access internal services and potentially sensitive credentials. The issue stems from insufficient input validation in an upload endpoint, enabling attackers to redirect internal API calls. This presents a busines