NVD disclosure day
CVE-2026-35482
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A sandbox escape vulnerability in alf.io's extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. This could impact the confidentiality, integrity, and availability of the server.
CVE-2026-32625
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An authenticated user can exploit a vulnerability in LibreChat's server integration to expose sensitive credentials. This could lead to a compromise of cryptographic materials and database access for the affected organization. The risk involves unauthorized access to critical business data.
CVE-2026-49448
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Organizations using the authentik identity provider face a bypass vulnerability in the Source stage. This could allow unauthorized access to systems and data, creating business risk. The issue is addressed in updated versions.
CVE-2026-42849
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An authentik identity provider vulnerability could allow cross-site scripting (XSS) attacks, potentially impacting organizations by compromising user data and unauthorized access. The issue has been addressed in recent software versions.
CVE-2026-5076
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The ARMember Premium WordPress plugin has a password reset flaw, allowing attackers to take over user accounts by accessing plaintext reset keys. This could lead to unauthorized access and disruption for affected organizations.
CVE-2026-38967
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
CrowCpp HTTP response header injection allows unvalidated header values to be manipulated, potentially leading to attacks like XSS or cache poisoning. This vulnerability, affecting CrowCpp up to version 1.3.1, poses a critical risk to the integrity and availability of web services and user interactions. It is uncertain
CVE-2026-42074
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
The OpenClaude command-line interface, prior to version 0.5.1, contains a vulnerability where a model can bypass security sandboxing and execute arbitrary commands on the host system. This occurs when a prompt-injected model is able to set a parameter to disable the sandbox, especially with default configurations that
CVE-2026-0611
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability in Spacelabs Healthcare Sentinel systems may allow unauthenticated attackers to execute arbitrary code remotely through a deprecated .NET Remoting channel if port 8989 is intentionally network-accessible. This could enable attackers to read and write files, potentially leading to remote code execution.
CVE-2026-47117
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
OpenMed's PII privacy-filter model loading path contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code with the service's privileges. This occurs when a malicious model repository is supplied via the `model_name` parameter. The core concern is to determine if this
CVE-2026-7198
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in Progress Sitefinity web services permits unauthenticated remote attackers to access restricted content. This can result in a complete compromise of confidentiality, integrity, and availability for affected installations when reachable.
CVE-2026-42684
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A blind SQL injection vulnerability exists in the WP Job Portal, potentially allowing unauthenticated attackers to manipulate database queries over the network and access sensitive information. The risk involves unauthorized data access and system compromise. Confirming the use and exposure of this product is crucial f
CVE-2026-34906
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical Server-Side Template Injection vulnerability in Wirtualna Uczelnia allows unauthenticated attackers to execute remote code. Insufficient input validation in URL redirection parameters enables attackers to inject and execute arbitrary template expressions on the server, potentially leading to command executio
CVE-2025-53209
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical privilege escalation vulnerability exists in Masteriyo LMS PRO, allowing unauthenticated attackers to gain unauthorized administrative control. This could impact system data and service integrity.
CVE-2026-8206
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The Kirki WordPress plugin has a critical privilege escalation vulnerability. Unauthenticated attackers can exploit this by sending password reset links to their own email addresses, leading to account takeovers. This could allow unauthorized access and modification of website content or user data.