NVD disclosure day
CVE-2026-48777
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A path traversal vulnerability exists in FileBrowser Quantum, a self-hosted file manager. This flaw allows an attacker with a public share link that permits modifications to move, copy, or rename files outside the intended shared directory. The issue stems from improper path handling before sanitization, enabling unaut
CVE-2026-22313
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A critical vulnerability exists in a device's web server REST API, allowing authenticated attackers to execute arbitrary commands with administrative privileges. While this flaw could lead to a complete system compromise, it is currently classified as unlikely to be externally exploitable as it resides on a management
CVE-2026-53776
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A JWT validation vulnerability in Perry allows remote attackers to bypass token expiration, potentially granting indefinite authenticated access using previously issued tokens. This could circumvent session invalidation mechanisms like logouts or revocations, posing a significant risk to systems relying on this JWT ver
CVE-2025-13036
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An authentication bypass exists in FactoryTalk Historian Site Edition, allowing an attacker to obtain a valid token by sending continuous requests to the login endpoint. The primary concern is understanding if this affects your systems, as FactoryTalk Historian Site Edition is typically isolated within internal network
CVE-2026-12316
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in the DOM security component can allow attackers to bypass security measures in web browsers and email clients. This could lead to unauthorized access and modification of data if a user interacts with malicious content. Affected applications have been updated to address this issue.
CVE-2026-12315
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability exists in the DOM security component of certain widely used web and email software, allowing for a mitigation bypass. This could lead to significant compromise of user data and system integrity if exploited, particularly given its high severity and the potential for unauthorized access and exec
CVE-2026-12304
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A same-origin policy bypass vulnerability exists in the Networking: Cookies component of certain web browser and email client software. If reachable, this could allow unauthorized access to sensitive information or manipulation of web content by a malicious website. This could occur when a user interacts with compromis
CVE-2026-40750
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unrestricted file upload vulnerability exists in the Kids Online Store, enabling authenticated users to upload web shells to the server. This could allow for arbitrary code execution and potentially a full system compromise. The issue arises from inadequate restrictions on file types that can be uploaded, making the
CVE-2026-52715
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated SQL injection vulnerability exists in the GEO my WordPress plugin. This could allow an attacker to execute arbitrary SQL commands, potentially leading to unauthorized access or manipulation of database information, affecting service availability.
CVE-2026-49774
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical code injection vulnerability in RD Station allows remote code inclusion. This means an attacker could potentially execute arbitrary code on a system, leading to unauthorized access or compromise. It's important to confirm if this technology is in use and assess any potential exposure.
CVE-2026-49772
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A Blind SQL Injection vulnerability in The Events Calendar plugin may allow an attacker to inject malicious database commands and potentially access sensitive information. This issue is reachable via network requests and affects the underlying database. Organizations should confirm if this plugin is in use and assess p
CVE-2026-39574
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated SQL injection vulnerability exists in the InPost Gallery plugin, allowing attackers to execute arbitrary SQL commands and potentially access sensitive data. This is a critical issue for websites using the plugin, as it could lead to unauthorized data access or service disruption. Confirmation of its