NVD disclosure day
CVE-2026-60372
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in Oracle Platform Security for Java allows unauthenticated network attackers to achieve complete system takeover. This could impact confidentiality, integrity, and availability. Confirming relevance and assessing network exposure is crucial.
CVE-2026-60369
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Oracle Platform Security for Java within Oracle Fusion Middleware, allowing a low-privileged attacker with network access via HTTP to potentially take over the affected component and impact other products.
CVE-2026-60367
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in Oracle Platform Security for Java allows unauthenticated attackers with network access to take over the affected system. This issue impacts Oracle Fusion Middleware and could lead to significant confidentiality, integrity, and availability consequences.
CVE-2026-60366
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Oracle Platform Security for Java (part of Oracle Fusion Middleware) that allows unauthenticated attackers with network access to compromise the product, potentially leading to a complete takeover and impacting other Oracle products.
CVE-2026-64798
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in a Joomla extension that generates persistent URL login keys using weak randomness, potentially allowing unauthorized access. This issue impacts systems using the extension for IP-based logins, where attackers could discover or guess these predictable keys. Understanding this threat is
CVE-2026-64796
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in a Joomla extension allows for code injection, potentially enabling unauthorized execution of PHP code if reachable. This could impact website integrity and content.
CVE-2026-64793
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Certain Joomla content management extensions have a vulnerability that could allow unauthorized access to restricted or unpublished content. This occurs when content tags incorrectly handle access controls, potentially exposing sensitive information to website visitors. This matters because it could lead to unintended
CVE-2025-50329
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability in Power Archiver allows remote attackers to escalate privileges and execute arbitrary code via powerarc.exe. This could lead to a compromise of affected systems if a specially crafted file is opened. Organizations should verify if this software is in use and understand its potential exposure.
CVE-2026-64829
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A session invalidation vulnerability exists in Question2Answer software. Attackers who obtain a valid "remember-me" cookie can exploit the password reset flow to maintain authenticated access. This occurs because the software fails to clear the session code during the reset process, allowing the old cookie to continue
CVE-2026-13072
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A memory corruption vulnerability exists in standalone `mongod` instances when a non-default compute mode is explicitly enabled. This flaw could lead to process termination or unintended behavior if an attacker can provide specially crafted BSON data. Understanding if this specific configuration is active in your envir
CVE-2026-16624
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in Cal.com OSS permits authenticated users to create webhooks for any team, potentially exposing sensitive booking data like attendee emails and custom responses, and even video-call passwords. This could lead to data theft and compromise system integrity.
CVE-2026-46738
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An improper input validation vulnerability exists in Dell PowerProtect Data Manager's REST API. A privileged attacker with remote access could exploit this to elevate their privileges, potentially impacting data management services.
CVE-2026-40712
Halo Surface Signal: 3 out of 5 — possibly public-facing.
Dell PowerProtect Data Manager's REST API has an improper input validation vulnerability that a high-privilege attacker with remote access could exploit to elevate privileges. This could allow an attacker to gain greater control over the system.
CVE-2026-16606
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability exists in Fujitsu Software's openFT technology for Linux and Oracle Solaris that permits unauthenticated remote code execution. This means an attacker could run unauthorized commands on affected systems without needing credentials, if the technology is reachable. Organizations should confirm if they use
CVE-2026-2395
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection vulnerability exists in a no-code platform, enabling attackers to execute arbitrary SQL commands without authentication. This could lead to unauthorized access, modification, or deletion of sensitive data, potentially impacting the integrity and availability of applications built with the platform. The
CVE-2026-62144
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An authentication bypass vulnerability exists in Check Point Security Management products, enabling unauthenticated remote attackers to execute administrative commands. This could lead to command execution on management servers and potentially on connected security gateways if the server is network-accessible without a
CVE-2026-16232
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An authentication bypass vulnerability in Check Point SmartConsole allows unauthenticated remote attackers to gain full administrative access, enabling modification of security policies. Exploitation requires internet access to the Management Server and a specific configuration. This vulnerability is being actively exp
CVE-2026-8152
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Unblu Spark has a vulnerability that allows open redirects, which can be escalated to DOM-based cross-site scripting (XSS). If exploited, an attacker could execute malicious JavaScript within your host application, potentially accessing sensitive data and resources. This risk is rated critical for on-premises deploymen
CVE-2026-63048
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in the Joomla extension Page Builder CK that allows authenticated users to upload arbitrary files, potentially leading to remote code execution. This could compromise the integrity and availability of the Joomla site and its infrastructure if the extension is in use and reachable.