NVD disclosure day
CVE-2026-46266
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A Linux kernel vulnerability allows specially crafted ICMP packets to alter the FNHE cache. This could lead to system configuration changes or denial of service when a RAW socket is configured to accept any IP protocol.
CVE-2026-46244
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in the Linux kernel's netfilter component could allow attackers to forge transport headers and bypass firewalls. This occurs due to an incorrect calculation of the transport header offset when processing inner IPv6 packets with extension headers. The issue affects specific Linux kernel versions and coul
CVE-2026-20230
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in Cisco Unified Communications Manager and Session Management Edition could allow an unauthenticated attacker to write files to the operating system, leading to root privilege escalation. This is due to improper input validation for certain HTTP requests, though exploitation requires the WebDialer serv
CVE-2026-36748
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
RockRMS has a cross-site scripting vulnerability in its user profile social media links. This could allow an attacker to execute malicious scripts in a user's browser, potentially leading to unauthorized access to sensitive information or actions performed on behalf of the user. It is uncertain if this technology is us
CVE-2026-36576
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An OS command injection vulnerability exists in the `app.py` component of openlabs docker-wkhtmltopdf-aas. Attackers can exploit this by sending a crafted POST request, allowing arbitrary command execution. This could impact system integrity and data security.
CVE-2026-5241
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in the huggingface/transformers library allows for arbitrary code execution during model initialization, even when remote code execution is disabled. This occurs because untrusted configuration data can override security settings, enabling an attacker to run malicious Python modules when a model is load
CVE-2026-35075
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated remote attacker can recover a default, hard-coded password from firmware, gaining full access to affected devices. This vulnerability affects various mbs-solutions gateway products. The primary concern is to confirm which devices are relevant and how they are exposed.
CVE-2026-47065
Halo Surface Signal: 3 out of 5 — possibly public-facing.
Vulnerabilities in a Java library allow attackers to bypass deserialization filters and trigger static initializers in allow-listed classes, potentially leading to unintended code execution when processing untrusted serialized data. The issues are addressed, but their impact depends on system integration.