NVD disclosure day
CVE-2026-64863
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the goshs file server allows remote, unauthenticated attackers to delete or overwrite files using WebDAV MOVE requests. This could lead to data loss or integrity issues if the affected file server is accessible over a network. Confirmation of goshs usage in the environment is needed to assess relevan
CVE-2026-62325
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in a file server tool allows unauthenticated access to files if specific settings are misconfigured. This could lead to unauthorized data access and modification. It is important to determine if this tool is in use and if it is deployed in a vulnerable manner.A critical vulnerability in the gos
CVE-2026-54658
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A critical SQL injection vulnerability exists in Hypequery's `escapeValue` function, potentially allowing attackers to inject malicious SQL into ClickHouse. This impacts data integrity and confidentiality for applications using Hypequery prior to version 2.0.2.
CVE-2026-6881
Halo Surface Signal: 3 out of 5 — possibly public-facing.
SQL Injection in Ellucian Advance's Giving Reports allows authenticated users to extract sensitive database information via a crafted query in the class credit field. This vulnerability impacts Ellucian Advance Web and Legacy Advance, potentially exposing institutional data. Uncertainty exists regarding the specific da
CVE-2026-14973
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
IBM Aspera Desktop App contains a vulnerability allowing files to be written outside designated download locations. This could impact user file integrity if reachable, although its relevance to desktop applications is generally limited.
CVE-2026-14959
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in IBM Aspera Faspex could allow a remote, authenticated attacker to inject commands, potentially leading to arbitrary code execution. This poses a risk to the integrity and availability of the file transfer system and any data it handles. Readers should confirm if this software is in use and exposed.
CVE-2026-14958
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
IBM Aspera Faspex has a vulnerability allowing authenticated users to execute arbitrary code by exploiting unquoted shell interpolation, potentially enabling unauthorized access and data manipulation.
CVE-2026-14512
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
IBM WebSphere Application Server has a critical pre-authentication vulnerability that could let an unauthenticated attacker bypass security or run unauthorized code remotely. This issue should be a concern because it impacts the confidentiality and integrity of applications and data. Uncertainty exists regarding specif
CVE-2026-14446
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
IBM WebSphere Application Server contains a broken access control vulnerability in its administrative console. If reachable, this could allow an unauthenticated attacker to gain administrative privileges and control the server. Confirmation of use and assessment of exposure are critical.
CVE-2026-50737
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability in pglogical allows a publisher to execute arbitrary functions as a superuser on a subscriber. This occurs when replicated changes are applied to a row missing columns, causing default expressions to run with elevated privileges. The issue is most relevant in managed deployments where non-superuser role
CVE-2026-50736
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability exists in the pglogical queue mechanism that allows a publisher to execute arbitrary SQL on a subscriber with superuser privileges. This could lead to a privilege escalation and compromise tenant isolation in shared deployments. Exploitation requires the attacker to control a subscription endpoint, maki
CVE-2026-51271
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A heap-based buffer overflow exists in WAV header parsing, which could allow an attacker to execute arbitrary code, disclose sensitive information, cause denial of service, or escalate privileges by processing a malicious WAV file. The need to determine if this technology is used within our environment and its potentia
CVE-2026-51268
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A heap-based buffer overflow exists in the host parsing logic of ESP32-audioI2S, triggered by untrusted network input. This could allow attackers to overflow memory, potentially impacting system integrity and availability. Confirmation of network exposure and device configuration relevance is necessary to understand th
CVE-2026-51267
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A critical heap-based buffer overflow vulnerability exists in the URL path processing of the ESP32-audioI2S component. Remote attackers could exploit this by sending a malicious, oversized URL to trigger an out-of-bounds write, potentially leading to arbitrary code execution, information disclosure, or service disrupti
CVE-2026-51266
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A heap buffer overflow in an ESP32 audio library allows remote attackers to execute arbitrary code by sending crafted network requests with oversized parameters. This could compromise affected devices and their data.
CVE-2026-51263
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An unauthenticated remote attacker could exploit a heap buffer overflow in an audio library for ESP32 microcontrollers by sending oversized malicious string data. This vulnerability, stemming from inadequate input validation during JSON and HTTP request construction, can lead to memory corruption, potentially impacting
CVE-2026-67174
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A DOM-based cross-site scripting vulnerability exists in Pivotick's UI component library, potentially allowing an unauthenticated attacker to execute arbitrary JavaScript in a user's browser by crafting UI elements or icons. This could lead to unauthorized access to sensitive information, manipulation of application da
CVE-2026-66713
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A deserialization vulnerability in Apache Axis2's Tribes clustering component could allow remote attackers to execute arbitrary code if the clustering feature is enabled. This issue stems from the deserialization of untrusted data sent over the cluster channel. Attackers can exploit this by delivering a crafted seriali
CVE-2026-51261
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A race condition in an audio processing library can lead to memory corruption and arbitrary code execution. This occurs due to missing synchronization when calculating buffer space, potentially allowing an attacker to cause a heap out-of-bounds write. The primary concern is identifying if this specific technology is in
CVE-2026-51260
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A heap buffer overflow can occur in the ESP32 audio processing library due to an unsafe memory copy operation. This could allow remote attackers to write out-of-bounds to memory. It is uncertain if this function is exposed to external networks within our environment.
CVE-2026-51259
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An unchecked integer overflow in an ESP32 audio processing library allows for memory corruption and potential code execution. While the vulnerability is network-exploitable, its exposure is considered very unlikely due to the embedded nature of the affected technology.
CVE-2026-51252
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A buffer overflow vulnerability exists in an embedded audio processing component due to inadequate validation of MP3 metadata, potentially allowing for remote exploitation. While the specific impact is uncertain, it could lead to denial of service or unintended code execution if reachable. It is important to confirm if
CVE-2026-65880
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability exists in a Joomla extension for form building, allowing unauthenticated attackers to execute remote code. This flaw arises from insecure form processing logic, particularly with the signature field type. Organizations using this extension should assess its relevance and exposure to understand
CVE-2026-16462
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in PROCON-WEB SCADA's 'GetGridData' endpoint allows unauthenticated remote attackers to execute arbitrary SQL commands due to improper input sanitization. This could lead to unauthorized access and modification of system data, which is a concern for leaders overseeing operational technology environments
CVE-2026-11841
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability exists in an application engine's file access feature, allowing unauthenticated network access to read and write sensitive filesystem areas. This exposure could lead to the modification of application settings, including customer passwords, and the potential execution of arbitrary code, impacti
CVE-2026-15014
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in a WordPress plugin allows unauthenticated attackers to bypass authentication and take over user accounts, including administrator accounts. This is possible by exploiting the phone verification process, enabling an attacker to impersonate any user whose phone number is known or guessable. Be
CVE-2026-14545
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated attacker can take over any WordPress site using the TrueBooker plugin by resetting any user's password. This vulnerability can lead to complete website takeover. It is important to determine if this plugin is in use and if the affected functionality is exposed.