NVD disclosure day
CVE-2026-16280
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An integer overflow in GPU memory address calculations may lead to incorrect mappings, potentially allowing unauthorized access to unintended memory and resulting in corruption or information disclosure.
CVE-2026-61884
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the Tycon Systems TPDIN-Monitor-WEB2 web management interface allows unauthenticated remote attackers to bypass login by submitting empty credentials. This grants administrative access, potentially enabling attackers to disrupt connected infrastructure or cause physical damage to equipment by control
CVE-2026-62835
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An improper authorization vulnerability in the Azure Portal may allow an unauthorized attacker to disclose information over a network. This could impact data confidentiality when the portal is accessed.
CVE-2026-64232
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in the Linux kernel's block layer could allow for system instability or crashes in environments using specific stacked storage configurations. This occurs due to incorrect accounting of data integrity segments during cloned request processing. Confirmation is needed on whether affected configurations ar
CVE-2026-64216
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability exists in the Linux kernel's network filesystem component that could lead to a use-after-free condition. This flaw might allow an attacker to compromise system integrity and data confidentiality.
CVE-2026-58630
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Improper access control in Azure App Service, a cloud service for hosting web applications, can allow an unauthorized attacker to elevate privileges over a network. This vulnerability, rated critical, could lead to significant unauthorized access and control if exploited. The potential for this service to be internet-f
CVE-2026-58586
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The Image::WebP module for Perl contains a vulnerable, bundled version of the libwebp library, which is not updated by system patches. Processing untrusted WebP images through this module could lead to code execution, and readers should care because system updates do not fix this issue.
CVE-2026-56163
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical flaw in Microsoft Azure Kubernetes Service allows unauthenticated network access to elevate privileges, potentially affecting service integrity and availability. This vulnerability, classified as externally reachable, warrants attention due to the potential for unauthorized privilege escalation.
CVE-2026-16634
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability exists in TOML::XS for Perl due to its use of the unmaintained tomlc99 library, which has an uncontrolled recursion flaw. Processing untrusted TOML data could trigger a stack overflow, potentially causing a denial-of-service condition. Its relevance depends on whether applications use this library to pa
CVE-2026-24727
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An unrestricted file upload vulnerability in the SUNNET Corporate Training Management System's e-paper draft upload function allows authenticated administrators to execute arbitrary commands by uploading a malicious ZIP archive. This could lead to unauthorized control of the system if the vulnerability is reachable.
CVE-2026-15704
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Eclipse BaSyx Go Components have an authorization bypass vulnerability where inconsistent trailing slash handling between the HTTP router and ABAC middleware can allow unauthenticated attackers to access protected API routes, potentially enabling unauthorized data operations. This issue affects ABAC-enabled deployments
CVE-2026-12877
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical SQL injection vulnerability exists in a WordPress plugin for project management and issue tracking, allowing unauthenticated attackers to inject malicious SQL code into database queries. If this plugin is used and exposed via its front-end issue tracker, attackers could potentially access or modify sensitive
CVE-2026-62825
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An improper authentication vulnerability in Azure Key Vault allows unauthorized network access to elevate privileges. This could impact the confidentiality and integrity of sensitive information managed by the service. It is uncertain if this issue is relevant or exposed in your environment.
CVE-2026-58275
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability in Azure DNS, caused by missing authorization, allows unauthorized attackers to elevate privileges over a network, potentially impacting DNS integrity and management. This exposure in a public-facing cloud service requires immediate confirmation of relevance and exposure within our environment.
CVE-2026-56191
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Microsoft Exchange Online has a critical improper authentication vulnerability. An unauthorized attacker could tamper with data over a network, potentially impacting service integrity. Organizations should verify their exposure to this cloud-based communication service.
CVE-2026-56165
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A heap-based buffer overflow in Microsoft Account services could allow an unauthorized attacker to execute code remotely. This affects a public-facing identity portal, potentially impacting system integrity and confidentiality. Determining relevance and exposure is key.
CVE-2026-56160
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Azure Red Hat OpenShift has an improper authorization vulnerability allowing an authenticated attacker to elevate privileges over a network. This could impact system integrity and availability. Confirming relevance and exposure is a priority.
CVE-2026-54120
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Microsoft Surface devices have an improper input validation vulnerability allowing an authorized attacker to execute code over a network, potentially impacting system confidentiality, integrity, and availability. Organizations should confirm if their Surface devices are relevant and exposed to this threat.
CVE-2026-50517
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical deserialization vulnerability in M365 Copilot could permit an authorized attacker to execute arbitrary code over a network. This presents a significant risk to system data, integrity, and availability, requiring immediate attention to confirm exposure and plan remediation.