NVD disclosure day
CVE-2026-56700
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Grav CMS has critical code-execution vulnerabilities due to unsafe deserialization and command injection flaws, allowing attackers to run arbitrary code. These issues can be triggered through crafted input or during plugin/theme installation, potentially compromising the server.
CVE-2026-56415
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A command injection vulnerability in Storage Concentrator's debug.pl script allows unauthenticated remote attackers to execute arbitrary commands with root privileges. This could lead to unauthorized system access and control.
CVE-2026-56413
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A command injection vulnerability exists in the Storage Concentrator's `ms_service.pl` service. Unauthenticated remote attackers can exploit this by sending a crafted network packet to execute arbitrary commands with root privileges, potentially impacting system integrity and availability.
CVE-2026-56278
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A security flaw exists in Flowise where a weak, hardcoded default secret for session management can be exploited. If this default secret is not changed, an attacker can forge session cookies to bypass authentication and impersonate users, potentially leading to unauthorized access. It is uncertain if sensitive data is
CVE-2026-56264
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Crawl4AI's Docker API server contains an arbitrary JavaScript execution vulnerability in the `/execute_js` endpoint. If reachable, an attacker could execute JavaScript with relaxed security settings, potentially enabling server-side request forgery against internal services. It is uncertain if this technology is in use
CVE-2026-55721
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical SQL injection vulnerability exists in Storage Concentrator products, specifically within the login.pl and debug.pl scripts. Unauthenticated remote attackers can exploit this by sending specially crafted cookie values, allowing them to manipulate database queries and potentially extract sensitive information
CVE-2026-14152
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in ANGLE, a component of Google Chrome, allows for an out-of-bounds read and write. If reachable, an attacker who has compromised the renderer process could exploit this via a crafted HTML page, potentially leading to a sandbox escape. This issue is relevant if user-facing Chrome deployments are present
CVE-2026-14121
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Google Chrome's Chromoting feature on Linux allows remote code execution via malicious network traffic. While the Chromium security severity is low, a critical CVSS score indicates a significant risk if this feature is reachable, potentially leading to system compromise.
CVE-2026-14120
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Google Chrome's DevTools could allow a compromised renderer process to escape the browser sandbox via a crafted HTML page. The specific impact and exploitability are uncertain, but it highlights a potential avenue for further system compromise if the affected component is reachable.
CVE-2026-14113
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Google Chrome's Updater on Windows could allow a sandbox escape. This requires an attacker to have already compromised the browser's renderer process and then present a specially crafted HTML page. The Chromium security team rates the severity as low.
CVE-2026-14109
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability exists in Google Chrome's Mojo component that could allow a remote attacker, after compromising the renderer process, to escape the browser's sandbox via a crafted HTML page. The Chromium security severity is rated as Low.
CVE-2026-14106
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Google Chrome on Android has a vulnerability where insufficient input validation could allow a compromised renderer process to escape the browser sandbox. This is triggered by visiting a crafted HTML page, potentially impacting system data and service behavior. The exact risk depends on how the technology is used and a
CVE-2026-14105
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Google Chrome's Speech component could allow a remote attacker to bypass the same-origin policy via a crafted HTML page. This might enable unauthorized access to sensitive information or manipulation of web services within a user's browser. The risk is considered low due to the requirement for a user
CVE-2026-14104
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Google Chrome has a vulnerability in WebAppInstalls that may allow remote attackers to execute arbitrary code via a crafted HTML page. While the flaw could allow code execution inside the browser's sandbox, exploitation requires user interaction, making the risk to the organization very unlikely.
CVE-2026-14101
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Google Chrome's sandbox technology on Mac may allow an attacker who has compromised the renderer process to escape the sandbox via a crafted HTML page. This could potentially lead to unauthorized access to sensitive system and user data.
CVE-2026-14097
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in Google Chrome on Mac allows a remote attacker who has compromised the renderer process to potentially escape the browser's sandbox by luring a user to a crafted HTML page. This could lead to unauthorized access to system resources. The Chromium security severity is rated as Low.
CVE-2026-14095
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A security flaw in Chrome allows a remote attacker who has compromised the renderer process to potentially escape the browser's sandbox via a crafted HTML page. This could impact system integrity and confidentiality when a user visits such a page. Identifying Chrome installations and assessing their reachability is imp
CVE-2026-14093
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Chrome's Cast feature could allow an attacker who has compromised the renderer process to escape the browser sandbox via a crafted HTML page. While the severity is rated low, this could potentially impact system integrity if a user visits a malicious site.
CVE-2026-14090
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in ChromeOS's CameraCapture component, allowing remote attackers to read out-of-bounds memory via a crafted HTML page. This could potentially expose sensitive information related to camera functionality. While the Chromium project rates this as low severity, its presence in a widely used browser
CVE-2026-14056
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Google Chrome's media component has a vulnerability that may allow a remote attacker who has compromised the renderer process to escape the sandbox using a crafted video file. This issue has a low security severity rating and is unlikely to be exploited in typical enterprise environments due to the specific conditions
CVE-2026-14055
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Google Chrome on Windows involves insufficient validation of untrusted input in Device Trust, potentially allowing a sandbox escape if an attacker has already compromised the renderer process and presents a crafted HTML page.
CVE-2026-14044
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability exists in ANGLE, a component within Google Chrome. If reachable, an attacker who has already compromised the renderer process could exploit this flaw via a crafted HTML page to potentially escape the browser's sandbox. This issue is relevant because sandbox escapes can escalate an attacke
CVE-2026-14043
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free flaw in Google Chrome's GetUserMedia functionality allows a compromised renderer process to potentially escape the browser's sandbox via a crafted HTML page. This could enable an attacker to gain broader access to a user's system.
CVE-2026-14038
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability exists in Google Chrome's New Tab Page that, if an attacker has already compromised the renderer process, could allow a sandbox escape via a crafted HTML page. This could potentially lead to unauthorized access or manipulation, and its relevance requires confirmation.
CVE-2026-14037
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Google Chrome's GPU component may allow a sandbox escape if a user visits a malicious webpage. This could potentially lead to unauthorized access. The exploit requires prior compromise of the renderer process.
CVE-2026-14017
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Google Chrome's navigation allows a remote attacker, with prior renderer process compromise, to potentially escape the sandbox via a crafted HTML page. This could enable code execution outside browser security boundaries.
CVE-2026-13934
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Google Chrome on Android allows a compromised renderer process to potentially escape the browser's sandbox via a crafted HTML page. This could enable unauthorized access to system resources. The primary concern is confirming if organizational Android Chrome usage is exposed to this risk.
CVE-2026-13920
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Google Chrome's media handling allows a remote attacker to escape the browser's sandbox via a crafted HTML page. This could potentially lead to broader system compromise by breaking out of the restricted environment. The exploit requires user interaction and a compromised renderer process.
CVE-2026-13909
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Chrome's DevTools may allow an attacker who has already compromised the renderer process to escape the browser sandbox. This could enable elevated privileges on the user's system, though it requires a prior compromise. While the immediate risk is low, understanding potential browser security exposure
CVE-2026-13901
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Google Chrome's Serial component allows a compromised renderer process to potentially escape the browser sandbox via a malicious HTML page. This could affect data or behavior within the renderer process if reachable and relevant. Further analysis is needed to confirm environmental relevance and poten
CVE-2026-13883
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A type confusion vulnerability in ANGLE, a component of Google Chrome, may allow a remote attacker to escape the browser's sandbox via a crafted HTML page, potentially impacting system resources.
CVE-2026-13882
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Google Chrome's USB handling could allow a compromised renderer process to escape the browser sandbox via a crafted HTML page, potentially impacting system integrity and confidentiality.
CVE-2026-13880
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Chrome's USB handling on macOS could allow a compromised renderer process to escape the sandbox via a crafted HTML page. This could potentially affect system data and service behavior.
CVE-2026-13878
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Google Chrome's Bluetooth component on Mac could allow a remote attacker to escape the browser's sandbox via a crafted HTML page. This requires the attacker to have already compromised the renderer process. The Chromium security team assessed this vulnerability's severity as Medium.
CVE-2026-13872
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Google Chrome on Android may allow a local attacker to escape the browser's sandbox via a malicious file. This could potentially impact the integrity and availability of the affected application.
CVE-2026-13869
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Google Chrome's Device component could allow a remote attacker to escape the browser's sandbox via a crafted HTML page. This could potentially lead to elevated privileges if the renderer process is already compromised and a user visits a malicious page. The relevance to our environment
CVE-2026-13861
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A use-after-free vulnerability in Google Chrome allows a remote attacker who has compromised the renderer process to escape the browser sandbox via a crafted HTML page. This could potentially affect system integrity or availability.
CVE-2026-13859
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A flaw in Google Chrome's ANGLE component could allow a remote attacker to escape the browser's sandbox via a crafted HTML page. This vulnerability is relevant for user-facing systems and could potentially lead to unauthorized access to system resources. Confirmation of relevance and any exposure within the environment
CVE-2026-13854
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Chrome's Ozone component on Linux could allow an attacker who has compromised the renderer process to escape the sandbox via a crafted HTML page, potentially impacting user systems.
CVE-2026-13853
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Chrome's Journeys component may allow a remote attacker to escape the browser sandbox via a malicious HTML page. This could potentially expose system data or allow for further compromise.
CVE-2026-13852
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Google Chrome on Android allows a local attacker to bypass access controls by tricking a user into visiting a malicious webpage. This could affect application installations on the device. The potential impact and relevance to your organization need to be confirmed.
CVE-2026-13851
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Chrome on Android allows a local attacker to bypass access controls via a crafted HTML page, potentially affecting data integrity and application functionality. This requires local access, making typical internet-based exploitation unlikely.
CVE-2026-13846
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Google Chrome's USB component allows a remote attacker who has compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page, which could impact user systems.
CVE-2026-13843
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Chrome for iOS allows a remote attacker to escape the browser's sandbox via a crafted HTML page. This could potentially impact user data and system integrity if exploited.
CVE-2026-13798
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A heap buffer overflow in Google Chrome's Chromecast component could allow a compromised renderer process to escape the browser sandbox via a crafted HTML page. This vulnerability could impact system data and service behavior.
CVE-2026-13797
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Google Chrome's Chromecast component allows a remote attacker, who has already compromised the renderer process, to escape the sandbox via a crafted HTML page. This could potentially affect system data integrity and confidentiality.
CVE-2026-13796
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An integer overflow in Google Chrome's Chromecast component could allow a compromised renderer process to escape the browser's sandbox via a crafted HTML page. This vulnerability is reachable over the network and requires user interaction to exploit.
CVE-2026-13792
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Google Chrome's Touchbar feature on Mac allows remote attackers to potentially escape the browser sandbox via a crafted HTML page. This could enable unauthorized access to the operating system if a user visits a malicious website. The likelihood of exploitation is considered very unlik
CVE-2026-13789
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Google Chrome's GPU component could allow a remote attacker to escape the browser sandbox by tricking a user into visiting a malicious HTML page, potentially leading to unauthorized system access.
CVE-2026-13785
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free flaw in Chrome's Bluetooth component on Mac could permit a remote attacker to escape the browser sandbox via a crafted HTML page and specific user gestures. This could potentially lead to system compromise.
CVE-2026-13782
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Google Chrome could allow a remote attacker to escape the browser's sandbox. This occurs if an attacker can compromise the renderer process and then trick a user into visiting a crafted HTML page. This could potentially impact system data and integrity.
CVE-2026-13781
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability in Google Chrome's Skia component allows a remote attacker, who has already compromised the renderer process, to potentially escape the sandbox via a crafted HTML page, impacting system data and service behavior.
CVE-2026-13780
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Insufficient input validation in ANGLE allows a remote attacker, with prior renderer process compromise, to escape the sandbox via a crafted HTML page. This could lead to broader system compromise if users visit malicious sites.
CVE-2026-13776
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A type confusion vulnerability in Google Chrome could allow an attacker who has compromised the renderer process to escape the browser's sandbox. This means a specially crafted HTML page could potentially lead to broader system access if reachable.
CVE-2026-13775
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A use-after-free vulnerability in Google Chrome's GPU component could enable a sandbox escape if a user visits a malicious HTML page. This could potentially allow an attacker who has compromised the renderer process to bypass security protections.
CVE-2026-58449
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated remote attacker can achieve code execution in txtai by exploiting an API endpoint when the API is exposed, authentication is disabled, and the index is writable. This vulnerability allows arbitrary code execution as the server process during reindexing. The risk is considered likely due to txtai's co
CVE-2026-50003
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in DCMTK clients using bit-preserving C-GET storage mode allows a malicious server to write files outside the designated directory. This could lead to unauthorized file manipulation if the client is connected to an untrusted server.
CVE-2026-37106
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in DokuWiki's registration function could allow remote attackers to create accounts without authentication. This is potentially intended behavior if self-registration is enabled, but could lead to unauthorized access if exploited. The relevance depends on the configuration of self-registration and exter
CVE-2026-11541
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability. An attacker could exploit this to interfere with how the server processes HTTP requests, potentially leading to unauthorized access or data manipulation. It is important to confirm if deployed instances are relevant and exposed.
CVE-2026-7874
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in IBM Langflow OSS could allow disclosure of stored credentials due to weak encryption. This affects systems used for building AI workflows and applications. The issue arises from a weak and reversible key derivation mechanism used for encrypting data at rest. If reachable, this could potentially expos
CVE-2026-7873
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
IBM Langflow OSS has a vulnerability that allows authenticated attackers to execute arbitrary OS commands and read sensitive files, potentially leading to system compromise. Readers should care because this could expose credentials and allow unauthorized access to the network. The uncertainty lies in confirming if this
CVE-2026-7871
Halo Surface Signal: 3 out of 5 — possibly public-facing.
IBM Langflow OSS is vulnerable to arbitrary code execution through access to a Redis instance. An attacker could compromise application secrets, data, and system integrity. Confirming relevance and exposure within your environment is crucial.
CVE-2026-7803
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in IBM Langflow OSS due to improper validation of flow nodes, potentially allowing arbitrary code execution. This issue affects how the software handles workflow automation and AI model orchestration components. The reachability and impact of this vulnerability depend on the specific dep
CVE-2026-7663
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
IBM Langflow OSS has an improper authorization vulnerability that could allow unauthenticated attackers to access protected project resources and execute operations. This is a concern if the technology is deployed and reachable, as it may lead to unauthorized access to sensitive information.
CVE-2026-13773
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability exists in IBM WebSphere Extreme Scale concerning CORBA stub classes that can lead to outbound Server-Side Request Forgery (SSRF) and, when chained with another flaw, Remote Code Execution (RCE). This occurs when processing attacker-controlled input during Java deserialization, potentially allowing an at
CVE-2026-13772
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An unauthenticated attacker could exploit a vulnerability in IBM WebSphere Extreme Scale's Object Query Language engine to execute arbitrary constructors on the JVM. This is possible because the OQL engine resolves attacker-supplied class names without sufficient validation. The attacker's ability to influence OQL quer
CVE-2026-13449
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical XML external entity injection vulnerability exists in IBM Business Automation Manager Open Editions, potentially allowing remote attackers to access sensitive information or consume memory. This issue is relevant if your organization uses this IBM product, as it could lead to data exposure or denial of servi
CVE-2026-11714
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A server-side request forgery vulnerability exists in IBM WebSphere Application Server Liberty when the `apiDiscovery-1.0` feature is enabled. This flaw could allow an unauthenticated attacker to trick the server into making requests to arbitrary hosts, potentially exposing internal network resources or sensitive infor
CVE-2026-11712
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
IBM WebSphere Application Server has a cross-site scripting vulnerability in its administrative console help system. If reachable, this flaw could allow an attacker to execute malicious scripts in a user's browser, potentially leading to the exposure of sensitive information. You should care if your organization uses t
CVE-2026-11708
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A cross-site scripting vulnerability exists in the administrative console's integrated help system for IBM WebSphere Application Server. If reachable, an attacker could inject malicious scripts, potentially leading to script execution in a user's browser within the console's context. This vulnerability could impact sys
CVE-2026-11546
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A server-side request forgery vulnerability exists in IBM WebSphere Application Server Liberty when the adminCenter-1.0 feature is enabled. This could allow an unauthenticated attacker to make the server issue requests to arbitrary internal or external resources, potentially exposing sensitive information or disrupting
CVE-2026-10560
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
IBM Langflow OSS has a missing authentication vulnerability in its API endpoints that could allow unauthenticated attackers to read build event data or cancel jobs. This may result in the disclosure of sensitive information and denial of service if the affected endpoints are reachable.
CVE-2026-10140
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An improper shared-state handling vulnerability exists in IBM Langflow OSS voice mode. An authenticated attacker could manipulate cache state to reuse API clients across tenant boundaries, causing requests to be processed with incorrect upstream API credentials. This could lead to cross-tenant billing and accountabilit
CVE-2026-10134
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in IBM Langflow OSS allows unauthorized access and manipulation of secrets, flows, conversations, and files within the Langflow database. Attackers could also connect to internal services, abuse cloud metadata, move laterally to other tenants, and establish persistence by modifying code, leadin
CVE-2026-10109
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
IBM Db2 is vulnerable to remote code execution through improper DRDA handshake handling, potentially allowing unauthenticated attackers to gain control. This critical flaw could impact data integrity and system availability. Understanding the specific exposure and relevance within our environment is crucial.
CVE-2026-58138
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Orkes Conductor that allows unauthenticated remote attackers to execute arbitrary operating system commands via the workflow API. This can occur by submitting malicious JavaScript or Python expressions within workflow definitions, which can then leverage unsandboxed GraalVM evaluators
CVE-2026-58370
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in Woodpecker CI systems when using the GitLab forge driver, allowing an attacker to bypass required pipeline approvals by spoofing the commit author name. This could lead to unauthorized code execution on Woodpecker agents and exfiltration of sensitive data. Readers should confirm if their envir
CVE-2026-58172
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Ocelot, an API gateway, has a security control bypass vulnerability allowing denied clients to circumvent IP-based access restrictions via WebSocket upgrade requests. This issue, stemming from omitted security middleware, could permit requests from blocked IP addresses to reach downstream services without proper enforc
CVE-2026-48315
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An Improper Input Validation vulnerability in Adobe ColdFusion enables attackers to achieve arbitrary code execution by tricking users into opening malicious files, potentially leading to elevated access or session control. This vulnerability requires user interaction and can result in the injection of malicious script
CVE-2026-48286
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Adobe Campaign Classic is affected by an incorrect authorization vulnerability that could allow arbitrary code execution in the context of the current user without requiring user interaction. This could impact the platform's ability to manage and deliver marketing campaigns.
CVE-2026-48283
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unrestricted file upload vulnerability in Adobe ColdFusion could allow attackers to execute arbitrary code. This issue does not require user interaction and can change the scope of an attack, potentially impacting system data and services. You should care because this critical vulnerability can lead to code executio
CVE-2026-48282
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Adobe ColdFusion is affected by a path traversal vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server without user interaction. This could lead to a complete compromise of the server's capabilities.
CVE-2026-48281
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An Improper Input Validation vulnerability in Adobe ColdFusion allows unauthenticated attackers to execute arbitrary code remotely. This affects the web application server platform, potentially leading to unauthorized access and control of the system.
CVE-2026-48277
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical Improper Input Validation vulnerability in Adobe ColdFusion could allow an unauthenticated attacker to execute arbitrary code remotely on affected servers. Exploiting this flaw does not require user interaction and could impact the confidentiality, integrity, and availability of systems. This issue is releva
CVE-2026-48276
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unrestricted file upload vulnerability in Adobe ColdFusion allows for arbitrary code execution without user interaction or authentication. Exploitation could enable an attacker to gain control within the context of the current user on the affected system.
CVE-2026-14241
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Memory safety bugs in Firefox have been found that could potentially allow an attacker to execute arbitrary code if reachable. This means an attacker might be able to control actions performed by the browser, affecting the user's system or data when the browser is used.
CVE-2026-6556
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in `@fastify/express` that allows unauthenticated attackers to bypass middleware, such as authentication or authorization, on prefixed routes. This occurs when non-string path arguments are used for middleware mounting within prefixed plugin scopes. Applications relying on this middleware for sec
CVE-2026-58116
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in LLaMA-Factory's WebUI allows unauthenticated remote code execution by supplying a malicious model path. This can lead to arbitrary Python code being run with the server's privileges, potentially compromising the application and its data. Organizations should assess if they use LLaMA-Factory
CVE-2026-58016
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A flaw in GLib's handling of malformed D-Bus introspection XML can lead to denial of service. This issue arises from a state confusion when processing specific XML structures, potentially causing an integer overflow and out-of-bounds read. The significance depends on whether this GLib component is exposed in a reachabl
CVE-2026-44946
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SAML authentication vulnerability in Rancher's Assertion Consumer Service handler did not enforce one-time use of SAML assertions, potentially allowing man-in-the-middle attacks. This could enable an attacker to replay SAML assertions, leading to unauthorized access to Rancher and potentially the environments it mana