NVD disclosure day
CVE-2026-48027
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A malicious version of Nx Console was briefly available, containing code that could harvest credentials. Organizations using the affected version could experience unauthorized access to sensitive information. Upgrading to a non-compromised version mitigates this risk.
CVE-2026-44330
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An unauthorized network attacker can access sensitive 5G core network data and control notification subscriptions within free5GC by using a forged token. This vulnerability affects the Network Exposure Function's PFD management interface, which lacks proper authorization checks. The reader should care because this coul
CVE-2026-44329
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
The free5GC Service Based Interface (SBI) has a vulnerability where network attackers can bypass authorization checks on SMF UPI endpoints. This allows unauthenticated access to read, write, or delete network link configurations, potentially impacting network operations.
CVE-2026-44327
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
The free5GC software, an open-source 5G core network implementation, has a vulnerability where its Network Exposure Function (NEF) allows unauthenticated access to administrative operations. A network attacker could reach the NEF on the Service Based Interface and access the OAM routes without proper authorization. Thi
CVE-2026-44326
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
free5GC's Network Exposure Function is vulnerable to unauthorized API calls, allowing attackers to manipulate traffic steering subscriptions. This could impact how network traffic is directed for users or groups, even if the service is configured as disabled.
CVE-2026-44315
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An open-source 5G core network component has a vulnerability in its NEF component that allows a network attacker to manipulate PFD management transaction state using forged tokens, even if the service is thought to be disabled. This could allow unauthorized API control.
CVE-2025-70103
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A heap buffer overflow vulnerability in the libjxl library could permit attackers to access or alter data by providing specially crafted PBM images. This poses a business risk to organizations relying on the library for image processing, potentially leading to service disruption or data compromise.
CVE-2026-8175
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A buffer overflow vulnerability in IBM Aspera's network transfer component could allow unauthenticated attackers to cause denial of service, bypass authentication, or execute remote code, impacting service availability and integrity.
CVE-2026-7876
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
IBM Aspera HSTS for CP4I is affected by an authentication bypass vulnerability that may allow unauthorized access to files. If reachable, this could expose sensitive data within the server's local storage when certain restrictions are absent. The concern lies in confirming the relevance and exposure of this technology
CVE-2026-7524
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
IBM Langflow OSS versions 1.0.0 through 1.9.1 have a remote code execution flaw due to improper symbolic link validation during archive extraction. This could allow an attacker to execute unauthorized code on affected systems, creating a significant business risk.
CVE-2026-46043
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability in the Linux kernel's RDMA component could allow specially crafted network packets to cause an integer underflow, potentially leading to system instability or unauthorized data access. This issue stems from insufficient validation of packet lengths and padding during data reception.
CVE-2026-46039
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A Linux kernel vulnerability has been fixed that could lead to an integer overflow during a length check, potentially impacting system integrity and availability. The issue involves the `rxgk` component's handling of ticket lengths. It is uncertain if this internal function is reachable or relevant in your specific env
CVE-2026-45988
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability exists in the Linux kernel's rxrpc protocol that could allow response packets to be re-decrypted incorrectly, potentially leading to data exposure or integrity issues. While not typically internet-facing, the protocol's network nature means that if reachable, this flaw could impact system confidentialit
CVE-2026-45972
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A flaw in the Linux kernel's SMB client can lead to memory corruption, potentially causing instability or compromise. This vulnerability is relevant if the SMB client functionality is exposed or used in your environment. The issue is resolved in newer kernel versions.
CVE-2026-45898
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A Linux kernel vulnerability in the RDMA/iWARP component can cause workqueue list corruption due to improper handling of submitted work items. This issue could potentially lead to system instability or crashes if triggered. The affected technology is part of the kernel's internal task management.
CVE-2026-48906
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in the Tassos Framework Plugin allows unauthenticated users to delete arbitrary files, potentially leading to site compromise. This issue affects widely used Joomla plugins, making data integrity and site operability significant concerns.
CVE-2025-13392
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability in Synology DiskStation Manager's single sign-on allows remote attackers to bypass authentication by exploiting an improper check for exceptional conditions. This could lead to unauthorized access to data and services if the attacker has prior knowledge of a distinguished name.
CVE-2025-12686
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A buffer overflow vulnerability in Synology BeeStation OS allows remote attackers to execute arbitrary code. This could lead to unauthorized access and potential data compromise for affected organizations. The realistic business risk involves a breach of system integrity and confidentiality.
CVE-2026-8450
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The HTTP::Daemon Perl module contains an OS command injection vulnerability. If reachable, an attacker could execute arbitrary commands on the server or manipulate files, posing a risk to system integrity. Confirming usage and exposure is crucial.
CVE-2026-9312
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A server-side request forgery vulnerability in GitHub Enterprise Server allows unauthenticated attackers to access internal services and potentially sensitive credentials. The issue stems from insufficient input validation in an upload endpoint, enabling attackers to redirect internal API calls. This presents a busines