NVD disclosure day
CVE-2026-54588
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Poweradmin, a DNS administration tool, contains a vulnerability where it improperly handles the HTTP Host header during authentication flows. This allows an unauthenticated attacker to manipulate redirects, potentially leading to full account takeover without credentials. Confirm if Poweradmin is in use to assess risk.
CVE-2026-11807
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in the Event-Driven Ansible websocket API allows authenticated users to expose sensitive credentials like OAuth tokens and vault passwords due to a missing authorization check. This could enable unauthorized access to protected resources. Confirmation of relevance and exposure within your environment is
CVE-2026-53753
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Crawl4AI, an open-source web crawler, has a critical vulnerability that allows unauthenticated attackers to execute arbitrary code. This is achieved by sending a specially crafted POST request to the `/crawl` endpoint, exploiting a sandbox escape in the computed fields feature. Given the tool's function, this could imp
CVE-2026-54257
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in the Electron framework may cause desktop applications to crash or mismanage memory due to incorrect byte length calculations. If reachable, this could lead to unexpected data truncation or allocation failures, impacting application stability. Teams responsible for Electron-based applications should i
CVE-2026-54157
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
LobeHub's proxy endpoint improperly handles URLs, enabling unauthenticated outbound requests from its infrastructure. This could expose sensitive details like Vercel deployment information and allow cookie injection onto the lobehub.com domain.
CVE-2026-53662
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in Immich, a self-hosted photo and video management solution, which could allow an attacker to compromise any authenticated user's account. The flaw on the login page enables an attacker to execute JavaScript within the user's browser via a crafted link, potentially leading to persistent account
CVE-2026-44726
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A flaw in Deno's Node.js TLS compatibility layer can cause application data to be transmitted in plaintext if an initial connection attempt fails and the connection retries. This could allow a network attacker to view or tamper with data that the application believes is securely transmitted.
CVE-2026-55450
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated vulnerability in Langflow allows network-accessible users to upload unlimited data, potentially exhausting server storage and leaking file paths. This could lead to service disruption or aid in further exploitation.
CVE-2026-55447
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in Langflow's RAG components allows an attacker to read arbitrary files from the file system by controlling input files, potentially leading to unauthorized data access.
CVE-2026-55255
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An Insecure Direct Object Reference vulnerability in Langflow allows an authenticated attacker to execute any AI flow belonging to another user by manipulating an API request. This could lead to unauthorized access and modification of AI agent functionality.
CVE-2026-50574
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
yt-dlp, a command-line downloader, has a vulnerability where insufficiently sanitized input to an external downloader like aria2c can lead to arbitrary file writes and potential code execution. This occurs when downloading fragmented manifest formats, with Windows systems being immediately vulnerable and other platform
CVE-2026-50023
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in yt-dlp allows a remote attacker to write arbitrary OS-shortcut files to a user's filesystem. This could occur when downloading media or subtitles, potentially leading to unauthorized actions on the user's system.
CVE-2026-48519
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Langflow's "Shareable Playground" feature has a critical vulnerability allowing unauthenticated remote code execution via public links. This means a user could be tricked into running arbitrary Python code by visiting a malicious link, potentially compromising the affected system. Organizations using Langflow should as
CVE-2026-44791
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An authenticated user with workflow creation or modification permissions in the n8n workflow automation platform can bypass a previous security fix in the XML node. This bypass, when combined with other nodes, could allow for remote code execution on the n8n host. This is a concern because n8n is often used as a centra
CVE-2026-44790
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An authenticated user with workflow modification permissions in n8n, an open-source workflow automation platform, can exploit a vulnerability to read arbitrary files from the server. This could potentially lead to a full system compromise if the affected functionality is reachable.
CVE-2026-44789
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in the n8n workflow automation platform. An authenticated user could exploit an unvalidated parameter to achieve global prototype pollution, potentially leading to remote code execution. This could compromise the n8n instance, impacting automated processes and connected systems.
CVE-2026-35019
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical authentication bypass vulnerability exists in NetComm NF20MESH routers using older firmware. Attackers can exploit a hardcoded encryption key to forge session cookies, gaining administrative control of the web management interface. This allows unauthorized access and configuration changes. Uncertainty exists
CVE-2026-28496
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A Server-Side Template Injection vulnerability exists in FOSSBilling's template rendering system, enabling administrators to inject and execute arbitrary code. This could result in the disclosure of sensitive information or remote code execution if reachable. Organizations using FOSSBilling should verify its relevance
CVE-2026-27604
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An authorization bypass in FOSSBilling's API allows unauthenticated access to privileged system endpoints, enabling attackers to execute administrative functions without credentials. This vulnerability could impact system integrity and operations if the affected API endpoints are reachable.
CVE-2026-56379
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
ImageMagick's SVG decoder has a command injection vulnerability that allows attackers to execute arbitrary commands by submitting malicious SVG files. This is a critical concern because ImageMagick is commonly used in web applications to process image uploads, potentially exposing internet-facing services to this threa
CVE-2026-56315
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in picklescan allows attackers to execute arbitrary code by crafting malicious pickle files that import unblocked Python standard library modules. This bypasses the software's safety validation, potentially enabling remote code execution if these files are processed. The issue is relevant because it can
CVE-2026-56258
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Crawl4AI contains a critical arbitrary file write vulnerability allowing unauthenticated attackers to write files outside intended directories via symlink and TOCTOU attacks on the output path. This could lead to code execution if the runtime user has write access to executable or cron locations.
CVE-2026-11374
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
ManageEngine products have a vulnerability where unauthenticated users can predict SSO tickets, potentially leading to account takeover. This impacts identity and access management systems, and its relevance to our environment needs to be confirmed.
CVE-2026-9733
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in a Perl OAuth2 authentication plugin due to insecure default generation of security tokens, enabling session hijacking via cross-site request forgery by exploiting predictable state parameters.
CVE-2026-12866
Halo Surface Signal: 3 out of 5 — possibly public-facing.
The expr-eval package has a critical code execution vulnerability in its `toJSFunction()` API. Attackers can supply crafted expressions that are compiled into native code, allowing them to bypass sandbox restrictions and run arbitrary JavaScript within an application's context. This poses a risk to applications that pr