NVD disclosure day
CVE-2026-67595
Halo Surface Signal: 3 out of 5 — possibly public-facing.
VaahCMS contains malicious JavaScript in its security email templates, which could execute code in a user's browser and capture sensitive information if the emails are rendered with JavaScript enabled. The vulnerability allows remote attackers to establish unauthorized WebSocket connections, install keyloggers, and scr
CVE-2025-69943
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection vulnerability exists in a Hospital Management System, allowing unauthenticated attackers to manipulate database queries via specific parameters. This could lead to unauthorized access or modification of sensitive data if the system is reachable.
CVE-2025-69942
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection vulnerability exists in Kishan0725 Hospital Management System's patient viewing component. Unauthenticated attackers can exploit this via network requests to potentially access or alter sensitive patient data. This issue is classified as external and likely affects internet-facing systems, warranting a
CVE-2025-67404
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Sourcecodester CASAP Automated Enrollment System is susceptible to SQL injection via parameters in `save_stud.php`, potentially allowing unauthorized data access or manipulation. The vulnerability's impact depends on whether the system is in use and exposed.
CVE-2025-67403
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical SQL injection vulnerability in the Sourcecodester CASAP Automated Enrollment System allows unauthenticated network access to manipulate the `class_name` parameter in `update_class.php`. This could lead to unauthorized data access or modification within the system's database, posing a significant risk if the
CVE-2025-65340
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection vulnerability exists in the kishan0725 Hospital Management System's reporting component, potentially allowing unauthorized access to sensitive data. If reachable, an attacker could manipulate database queries to read, modify, or delete information. This issue could impact data integrity and confidential
CVE-2026-67429
Halo Surface Signal: 3 out of 5 — possibly public-facing.
Flyto2 Core's file writing modules do not sufficiently validate output paths, allowing the process to write arbitrary data to any accessible filesystem location. This vulnerability could lead to system compromise or data manipulation if reachable. Its relevance depends on how Flyto2 Core is implemented and exposed with
CVE-2026-67426
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in Flyto2 Core's verification service could allow unauthenticated attackers to perform server-side requests and exfiltrate runner secrets. This impacts the core kernel for automation and AI-agent workflows. Understanding Flyto2 Core's role in your environment is key to assessing potential exposure.
CVE-2026-16326
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in `consul-mcp-server` allows a client's Consul authentication token to be used for subsequent requests from other clients when operating in stateless mode. This could lead to unauthorized access to session state and potentially sensitive information. Readers should care because this flaw could allow un
CVE-2026-14529
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical server-side request forgery vulnerability exists in IBM WebSphere Application Server when the SIP container feature is enabled, allowing unauthenticated attackers to make the server issue unintended requests to arbitrary network locations. This could potentially expose internal network structures or sensitiv
CVE-2026-41939
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A hard-coded credentials vulnerability in the Care Everywhere Gateway's WildFly management interface allows unauthenticated attackers to gain administrative access and execute code. The affected technology is an outdated, end-of-life product, but misconfigurations can expose it. Confirm relevance to avoid potential com
CVE-2026-18236
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in the Agent Development Kit (ADK) may allow an attacker to execute unauthorized tools by forging confirmation responses if session history can be manipulated. This occurs because the ADK does not adequately verify if a target tool is registered, requires confirmation, or if confirmation arguments match
CVE-2026-8338
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An authentication and authorization bypass vulnerability exists in Coverity Connect, enabling unauthenticated attackers to access sensitive data by sending specially crafted HTTP requests. This issue could allow unauthorized viewing of internal data within the static analysis results management platform. Readers should
CVE-2026-54680
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability exists in the logging operator that allows a user with Flow resource creation privileges to inject and execute arbitrary commands within the Fluentd aggregator. This could compromise the integrity and availability of logging data. Confirming relevance and exposure in your environment is important.
CVE-2026-51992
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A critical SQL injection vulnerability in ClickHouse Server may allow a remote attacker to execute arbitrary code. This issue could affect system data and behavior if exploited. It is uncertain if ClickHouse is deployed or reachable within the environment.
CVE-2026-20316
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in Cisco Secure Firewall Management Center's web interface allows unauthenticated, remote attackers to use static credentials for a low-privileged account to access sensitive data. The risk is reduced if the management interface is not publicly accessible, but Cisco notes this can be combined with other
CVE-2026-67192
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A pre-authentication stack buffer overflow in Xlight FTP Server allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated, potentially leading to remote code execution. This vulnerability is reachable over the network before any user authentication, posing
CVE-2026-67191
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Xlight FTP Server has a critical pre-authentication heap buffer overflow vulnerability. Remote, unauthenticated attackers can exploit this by sending a malformed SSH client identification string, potentially leading to service disruption or other severe consequences on SSH or SFTP connections before authentication. Thi
CVE-2026-60113
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A missing authentication vulnerability exists in the AMMOS Instrument Toolkit's Deep Space Network interface, allowing unauthenticated attackers to access unprotected API routes. Attackers could potentially control communication sessions, retrieve telemetry, or inject arbitrary frames into spacecraft links. Confirmatio
CVE-2026-60112
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in the AMMOS Instrument Toolkit GUI allows unauthenticated network attackers to issue arbitrary spacecraft commands by bypassing authentication during session creation, potentially impacting operations.
CVE-2026-54735
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Prebid Server, an open-source ad auction system, where improperly validated parameters can cause server-side requests to unintended destinations. This could expose internal network services or sensitive endpoints. Confirming relevance and public-facing exposure is essential for affect
CVE-2026-65888
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical account takeover vulnerability in a Joomla extension's social login feature allows unauthenticated actors to log in as any user. This could lead to unauthorized access to user accounts and their data on public-facing websites using the affected extension.
CVE-2026-65887
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A Joomla extension vulnerability allows unauthenticated password resets for non-admin users. An attacker can exploit this to log in as another user and perform actions on their behalf. This requires confirmation of relevance and exposure to your systems.
CVE-2026-65886
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated arbitrary file read vulnerability exists in the Gridbox Joomla extension's photo viewer. Attackers can exploit this to read any file on the server, potentially exposing sensitive information. Confirm if your organization uses this extension and assess your exposure.
CVE-2026-9177
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A Server-Side Template Injection vulnerability in Axway SecureTransport allows an administrator to execute arbitrary Java code when an email is sent, potentially leading to full server compromise. This impacts users of the product, especially those with administrative access who may not be aware of the risk.
CVE-2026-65890
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated SQL injection vulnerability exists in a Joomla extension, enabling unauthorized users to inject malicious SQL code into database queries, potentially leading to unauthorized data access or manipulation. The primary concern is confirming if this extension is in use and exposed online.The provided CVE
CVE-2026-65889
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in a Joomla extension allows unauthenticated actors to recursively delete directories, potentially leading to data loss and site disruption. Readers should care because this technology is often used in public-facing websites, making it a reachable threat. The primary concern is to confirm if th
CVE-2026-65885
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An authenticated arbitrary file upload vulnerability exists in the Gridbox Joomla extension, potentially enabling attackers to execute arbitrary code on the server if chained with another vulnerability. This issue affects systems running the affected Joomla extension.
CVE-2026-65884
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in a Joomla extension allows unauthenticated actors to escalate privileges by creating new administrative accounts. This could lead to unauthorized control over the affected website and its data. Confirming the use and reachability of this extension is crucial for assessing risk.
CVE-2026-0667
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability in the Modbus TCP protocol could allow an unauthenticated attacker to execute arbitrary code, disrupt services, or compromise data confidentiality and integrity. This issue is reachable via network communication over the Modbus TCP protocol, and its impact depends on the specific implementation and netw
CVE-2026-65883
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in a Joomla extension allows unauthenticated attackers to inject PHP objects, leading to remote code execution. This could enable attackers to compromise the web server hosting the extension by submitting a forged form field. Understanding if this extension is in use and externally reachable is
CVE-2026-14900
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability in a WordPress plugin allows unauthenticated attackers to execute arbitrary code on the server due to insufficient input sanitization before a PHP `eval()` function is called. The attacker can obtain necessary nonces from publicly available data, making the vulnerability easily exploitable on a
CVE-2026-14488
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in the Meta Box AIO WordPress plugin allows unauthenticated attackers to delete arbitrary posts and pages. The flaw is in the frontend submission feature, where deletion requests are not properly checked, enabling attackers to remove content without login or permissions if a submission form is
CVE-2026-59243
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
The FAB auth manager's Azure AD OAuth login can be bypassed by an attacker presenting a forged ID token, granting them access as any user, including administrators. This vulnerability impacts deployments using the default configuration, where signature verification is not enforced.
CVE-2026-58179
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in the Apache Traffic Server regex_remap plugin allows for stack and integer overflows from substitution input, potentially impacting server availability and integrity. This issue is relevant because Apache Traffic Server is an internet-facing gateway, and exploitation could lead to denial-of-service or
CVE-2026-58161
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability in Apache Traffic Server could allow an attacker to crash the service by sending malformed network traffic. This could disrupt services that rely on Apache Traffic Server for managing web traffic.
CVE-2025-10656
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the Spreadsheet Price Changer WordPress plugin allows unauthenticated attackers to create administrator accounts. This could lead to unauthorized control and potential compromise of affected websites. It is important to confirm the plugin's presence and relevance within your digital assets to assess
CVE-2026-58155
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Apache Traffic Server has a vulnerability where it truncates overly long header names, potentially allowing header aliasing, request smuggling, and policy bypass. This issue affects the server's request processing, and if reachable, attackers could exploit it to circumvent security measures. Organizations using Apache
CVE-2026-58154
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Apache Traffic Server is vulnerable to header parsing issues, potentially allowing out-of-bounds writes or integer overflows. This could impact the integrity and availability of the server and the services it manages.
CVE-2026-18191
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A hidden functionality vulnerability in Vacron VIN-DS783E-E6 devices allows unauthenticated remote attackers to obtain administrator credentials. This could lead to unauthorized device control. It is important to identify deployed devices and assess their reachability and business criticality.
CVE-2026-63234
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection and unsafe deserialization vulnerability in Koollab LMS allows an authenticated attacker to execute arbitrary code on the server by injecting data through the manual mark assessment endpoint. This could lead to unauthorized control of the system. If Koollab LMS is used and externally reachable, this iss
CVE-2026-63233
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in Koollab LMS permits authenticated attackers to execute arbitrary code via SQL injection and unsafe deserialization in the assessment answer endpoint, potentially leading to webshell creation and server compromise. Confirming Koollab LMS usage and its accessibility is essential.
CVE-2026-63232
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection and unsafe deserialization vulnerability in Koollab LMS could allow an authenticated attacker to execute arbitrary code on the server. This issue is reachable via the assessment reinforcement endpoint and could lead to system compromise. Readers should care because this vulnerability could enable unauth
CVE-2026-63230
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A pre-authentication SQL injection vulnerability in Koollab LMS allows unauthenticated attackers to read sensitive database contents, potentially leading to account takeover via stolen credentials and JWTs. This issue is relevant due to the LMS's typical web-facing nature and the exposure of the SCORM report endpoint.
CVE-2026-63229
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A pre-authentication blind SQL injection vulnerability in Koollab LMS could allow unauthenticated attackers to access sensitive database contents, including PII, credentials, and JWT tokens, potentially enabling account takeover.
CVE-2026-63227
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unrestricted SCORM file upload vulnerability in Koollab LMS allows an authenticated user to upload a PHP webshell, potentially leading to arbitrary code execution on the server. This could impact system integrity and data confidentiality, necessitating an assessment of organizational use of the affected technology.
CVE-2026-13423
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the Streamit WordPress theme allows unauthenticated attackers to call arbitrary PHP functions, potentially leading to privilege escalation and remote code execution. This could enable attackers to create administrator accounts or execute malicious code on the server. Confirmation of the theme's prese
CVE-2026-18072
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in a WordPress video embedder plugin, allowing unauthenticated attackers to bypass authentication and gain administrative control of a site. The flaw stems from a hardcoded backdoor that provides universal administrator credentials. This could lead to full site compromise and data manipu