NVD disclosure day
CVE-2026-82971
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical command injection vulnerability exists in a CGI script within QVidium Opera11. Exploitable remotely, this flaw allows attackers to execute arbitrary system commands by manipulating an `ipaddr` argument, potentially compromising system integrity and data. As the vendor is defunct and offers no support, organi
CVE-2026-82226
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated PHP object injection vulnerability exists in the Tickera event ticketing system. If reachable, this flaw could allow an attacker to execute arbitrary code, potentially impacting system confidentiality, integrity, and availability. Confirming the use and exposure of this system is essential.
CVE-2026-81780
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated arbitrary file upload vulnerability exists in Hash Form, a technology for managing online submissions. Attackers could exploit this to upload malicious files, potentially leading to system compromise and unauthorized access to data. Confirming its presence and relevance is crucial.
CVE-2026-81779
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An improper input validation vulnerability in the Newspapers X theme allows for the potential implantation of malicious software. This could affect the integrity and availability of websites using the affected theme versions, with a wide network attack surface.
CVE-2026-81763
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated SQL injection vulnerability exists in Throws SPAM Away, allowing unauthenticated attackers to access or manipulate database content via network requests. This could impact data integrity and service availability. Confirming its presence and reachability is crucial for affected systems.
CVE-2026-81756
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated SQL injection vulnerability exists in the Smart Marketing SMS and Newsletters Forms plugin. Attackers can exploit this to inject malicious code, potentially leading to unauthorized access to or modification of sensitive data. This issue is relevant to internet-facing marketing plugins.
CVE-2026-81293
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated SQL injection vulnerability exists in the WP Data Access component, potentially allowing attackers to access or modify sensitive database information. This issue is concerning because it can be reached via the network without authentication, posing a risk to data integrity and system availability in
CVE-2026-79408
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An OS command injection vulnerability in MetaGPT may allow an attacker to execute arbitrary commands. This could affect system integrity and availability if the technology is in use and exposed to attackers.
CVE-2026-38577
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Tenda routers, allowing unauthorized network access to gain root control through hardcoded administrator credentials. This could compromise device confidentiality, integrity, and availability. Given that routers are often internet-facing, it's important to determine if these devices a
CVE-2026-51740
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated attacker can terminate critical services on TOTOLINK routers by sending a crafted request to a specific interface, potentially causing network disruption. This is a concern for internet-facing devices.
CVE-2026-51738
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated network request can reset TOTOLINK router configurations and reboot the device, potentially disrupting services. This vulnerability resides in improper access controls within a specific function. Confirming the presence and exposure of affected devices is crucial.
CVE-2026-51736
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An access control flaw in TOTOLINK routers allows unauthenticated attackers to erase system logs via a crafted request. This could hinder troubleshooting and security monitoring.
CVE-2026-51734
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An access control vulnerability in TOTOLINK routers could allow unauthenticated attackers to trigger mesh slave updates. Attackers can exploit this by sending a crafted POST request, potentially impacting device integrity and availability. Confirming affected devices and assessing network exposure is crucial.
CVE-2026-51733
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An access control vulnerability in the firmware of TOTOLINK T6 routers allows unauthenticated attackers to remove Wi-Fi schedule entries. This could disrupt network operations by altering Wi-Fi availability. The relevance of this issue depends on whether the affected technology is in use and exposed.
CVE-2026-51731
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An access control flaw in a TOTOLINK device allows unauthenticated attackers to remove VLAN settings via a network request. This could alter network configurations. Confirmation is needed to determine if this affects your environment.
CVE-2026-53552
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Goploy, an open-source deployment system, has a vulnerability that allows a user with manager privileges to manipulate files and critical project configurations in any project, potentially leading to remote code execution during the next deployment. This issue impacts core deployment operations and could result in a br
CVE-2026-79748
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
MCPHub, a system for orchestrating MCP servers, has a vulnerability allowing authenticated users to execute arbitrary commands. This occurs because the system does not properly validate command and argument fields when creating or updating server configurations. An attacker could exploit this by submitting a malicious
CVE-2026-51730
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An access control vulnerability in TOTOLINK Wi-Fi routers allows unauthenticated attackers to remove Wi-Fi access rules. This could enable unauthorized network access or disruption. The vulnerability is reachable via network requests.
CVE-2026-51729
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An incorrect access control flaw in TOTOLINK routers allows unauthenticated attackers to request the deletion of managed devices via a crafted request to a specific CGI script, potentially disrupting network operations.
CVE-2026-51728
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated vulnerability exists in a router's firmware upload function, potentially allowing attackers to remotely upload malicious firmware. This could lead to unauthorized control or modification of the device, impacting its confidentiality, integrity, and availability. It is important to assess if any affect
CVE-2026-51726
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An access control vulnerability in TOTOLINK routers allows unauthenticated attackers to remove parental control rules via a crafted request. This could enable bypassing network restrictions. Confirm if this technology is in use and exposed within your environment.
CVE-2026-51725
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An incorrect access control vulnerability in TOTOLINK routers allows unauthenticated attackers to modify the device clock via a crafted POST request, potentially affecting time-sensitive operations or logs. This issue is relevant to the device's clock synchronization feature, which is accessible over the network.
CVE-2026-51724
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Improper access control in TOTOLINK routers allows unauthenticated attackers to remove Quality of Service rules via a crafted request, potentially disrupting network traffic management. The primary concern is confirming if this technology is in use within your environment.
CVE-2026-51723
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated attacker can exploit a critical access control vulnerability in TOTOLINK T6 routers by installing custom CGI modules. If reachable, this could allow unauthorized code execution, potentially leading to altered device behavior or unauthorized access. Confirming if your organization uses this technology
CVE-2026-51722
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An access control flaw in TOTOLINK Wi-Fi repeaters allows unauthenticated attackers to redirect the device to an attacker-controlled network via a crafted request. This could impact network traffic integrity and confidentiality if the devices are accessible. Confirming device deployment and network exposure is crucial.
CVE-2026-51721
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated attacker can alter the mesh pairing state of TOTOLINK devices by sending a crafted request, potentially impacting network integrity and device security.
CVE-2026-51720
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated attacker can remove firewall filter rules on TOTOLINK routers by sending a crafted request. This could weaken network defenses, potentially allowing unauthorized access or manipulation. The relevance and exposure of TOTOLINK routers should be confirmed.
CVE-2026-76133
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A deprecated hashing algorithm in an Ebyte product's authentication process may weaken security, potentially allowing unauthorized access if an attacker can manipulate authentication exchanges.
CVE-2026-73819
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An unauthenticated adjacent network attacker can exploit a vulnerability in the Ebyte product's vendor configuration utility. This flaw allows modification of critical settings or access credentials without proper identity verification, potentially hindering legitimate administrator control.
CVE-2026-51718
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated remote attacker can remove static DHCP reservations on TOTOLINK routers by sending a crafted request. This could disrupt network configurations and device connectivity.
CVE-2026-51717
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An incorrect access control vulnerability in TOTOLINK devices allows unauthenticated attackers to change the device's operating mode by sending a crafted request. This could impact network configuration and security if the device is reachable. Confirm relevance and assess exposure.
CVE-2026-51715
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated attacker can remove MAC filter rules from TOTOLINK routers by sending a crafted POST request. This could impact network access control. The technology is internet-facing home networking equipment.
CVE-2026-51713
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An incorrect access control vulnerability exists in TOTOLINK routers that allows unauthenticated attackers to manipulate the WAN dial state by sending a crafted request. This could affect internet connectivity.
CVE-2026-51711
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated network attacker can exploit an incorrect access control vulnerability in a TOTOLINK router's Wi-Fi Protected Setup function. This could allow them to initiate a wireless pairing window, potentially leading to unauthorized access. The primary concern is determining if affected devices are exposed and
CVE-2026-51710
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated attacker can alter parental control settings on a TOTOLINK router by sending a crafted request to a CGI interface. This could impact network access policies for connected devices. Readers should determine if affected devices are in use within their environment.
CVE-2026-51709
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated attacker can reconfigure primary Wi-Fi settings on TOTOLINK routers by sending a crafted request. This vulnerability, due to incorrect access controls, could allow unauthorized changes to network configurations. Organizations should confirm if these routers are in use and assess their exposure.
CVE-2026-51708
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An access control vulnerability in TOTOLINK T6 devices allows unauthenticated attackers to change WPS availability by sending a crafted request. This could impact network security as these devices are often externally reachable.
CVE-2026-51705
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated vulnerability in TOTOLINK T6 routers allows attackers to rename mesh network entries by sending a crafted request. This could enable unauthorized control or disruption of network configurations. Its relevance depends on the reachability and exposure of affected devices.
CVE-2026-51701
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An incorrect access control vulnerability in TOTOLINK devices allows unauthenticated attackers to change device access control settings by sending a crafted request. This could enable unauthorized modification of network access rules. This issue is relevant if such devices are used and potentially exposed.
CVE-2026-51700
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An access control vulnerability in a TOTOLINK router function allows unauthenticated attackers to degrade wireless network behavior by sending a crafted request to the web management interface. This could impact wireless network operations.
CVE-2026-51699
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An access control vulnerability in a router's configuration function allows unauthenticated attackers to potentially expose internal hosts. This could enable unauthorized access to network devices if the affected technology is reachable. Readers should confirm the relevance and exposure of this technology within their
CVE-2026-51698
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An access control vulnerability in TOTOLINK T6 devices allows unauthenticated attackers to alter browsing policies via crafted network requests. This could potentially impact internet access for users on affected networks. The vendor has not yet released a fix, and the relevance and exposure of this issue need to be co
CVE-2026-51152
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A server-side request forgery vulnerability in the /har/test endpoint allows unauthenticated attackers to force the QD server to send arbitrary HTTP requests to internal network resources and cloud metadata endpoints. This could potentially lead to unauthorized access or exposure of sensitive information. It is importa
CVE-2026-82970
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent WordPress plugin permits the upload of malicious files. This could enable an unauthenticated attacker to compromise website data or services. Determining the plugin's presence on internet-facing systems is a priority.
CVE-2026-66047
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability in a WordPress plugin allows unauthenticated attackers to install and activate arbitrary plugins, potentially leading to remote code execution. This is achieved by exploiting a weak token to trigger a silent plugin installation via a controlled URL. The primary risk is the compromise of the web
CVE-2026-59111
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability in the eObčanka-Identifikace application on MacOS allows for OS command injection via a custom URL scheme. An attacker could trick a user into opening a malicious URL, leading to the execution of arbitrary commands on the user's system. This is a concern if the application is installed and users interac
CVE-2026-51697
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated attacker can alter IPTV service configuration on TOTOLINK routers by sending a crafted request to a specific script. This could disrupt or redirect the IPTV service. Confirming the presence and network exposure of affected devices is crucial for security.
CVE-2026-51696
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An access control vulnerability exists in TOTOLINK routers that allows unauthenticated attackers to expose internal services by sending a crafted request. This could make internal network services accessible over the internet. Readers should confirm if their network is affected and understand the potential relevance to
CVE-2026-51693
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated access control vulnerability in a network device's VPN configuration function allows attackers to weaken edge filtering by sending a crafted request. This could impact network security.
CVE-2026-51692
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated attacker can modify guest Wi-Fi settings on a TOTOLINK T6 device by sending a crafted request. This could impact the availability or security of the guest network. Confirm if this device is deployed within your network and if it is exposed to external access.
CVE-2026-51691
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated access control vulnerability in TOTOLINK routers allows attackers to manipulate upload or flash workflows via a crafted POST request. This could compromise router integrity and configuration.
CVE-2026-51690
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated attacker can alter upstream provisioning and connectivity by sending a crafted request to a function in TOTOLINK routers. This could impact network configuration and internet access if the device's web interface is reachable via the internet. Confirming device presence and external reachability is ke
CVE-2026-51689
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An incorrect access control vulnerability exists in a function that handles firmware upgrades in TOTOLINK routers. This flaw could allow unauthenticated attackers to remotely alter the firmware upgrade process by sending a crafted request, potentially leading to unauthorized device modifications. It is important to con
CVE-2026-51687
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated attacker can create or weaken guest wireless access by sending a crafted POST request to the device's web interface, potentially impacting network security and availability.
CVE-2026-51686
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Improper access control in TOTOLINK wireless routers allows unauthenticated attackers to reconfigure or disable wireless networks by sending a crafted request. This could lead to a loss of network control and disruption of service.
CVE-2026-51684
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated attacker can exploit a network vulnerability in TOTOLINK routers by sending a crafted request to change storage configurations, potentially impacting service confidentiality, integrity, and availability. Given the common deployment of these devices at network edges and the potential for remote access
CVE-2026-51681
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An access control vulnerability in TOTOLINK networking devices may allow unauthenticated attackers to expose WAN-side administration settings. This could potentially allow unauthorized modification of network configurations, impacting network security. Confirming the presence and exposure of this technology is recommen
CVE-2026-51680
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An incorrect access control vulnerability in a TOTOLINK router's `setLedCfg` function allows unauthenticated attackers to modify LED behavior via a crafted POST request. This could lead to unexpected device behavior or be used as part of a larger attack, impacting network edge device security.
CVE-2026-51679
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated access control vulnerability in TOTOLINK routers allows attackers to change the administrator password via a crafted POST request. This could lead to unauthorized control over the router's settings and potentially impact network security. The presence and exposure of affected devices within an organi
CVE-2026-51677
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated attacker can exploit an access control flaw in TOTOLINK routers to change the UPnP service state. This could impact network service configurations, and its relevance depends on whether the affected device is in use and exposed.
CVE-2026-51676
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated attacker can alter access-device policies on TOTOLINK T6 devices by sending a crafted POST request. This vulnerability could allow unauthorized changes to network access control, potentially disrupting operations or facilitating unauthorized access. Readers should confirm relevance and exposure for t
CVE-2026-51675
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An access control vulnerability in TOTOLINK routers could allow unauthenticated attackers to reconfigure uplink settings by sending a crafted request. This could impact internet connectivity or allow unintended network traffic paths. Verify if your environment uses affected devices and assess their exposure.
CVE-2026-51674
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated attacker can force a reboot on TOTOLINK routers by sending a crafted request, potentially disrupting network operations. It is uncertain if this vulnerability is actively exploited or what specific business impact could occur.
CVE-2026-51672
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated attacker can obtain the roaming enablement flag by sending a crafted request to the router's management interface. This could expose sensitive network configuration details. Readers should confirm if affected TOTOLINK equipment is in use and assess potential exposure.
CVE-2026-51670
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An incorrect access control vulnerability in TOTOLINK routers allows unauthenticated attackers to query slave upgrade status and potentially affect upgrade bookkeeping by sending a crafted POST request to the device's web interface. This could lead to unauthorized information disclosure and manipulation of system proce
CVE-2026-51669
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in TOTOLINK routers allows unauthenticated attackers to obtain sensitive network configuration details via a crafted request. This could expose pairing and mesh-slave configurations, which is a concern for internet-facing network devices. Technical readers and security-aware leaders should conf
CVE-2026-82695
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability exists in Tenda network devices' Telnet handler, allowing unauthenticated remote access. An exploit is publicly available, potentially enabling attackers to gain control over the device. This issue is relevant if Tenda devices are in use and exposed to networks.A critical vulnerability exists i
CVE-2026-82694
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability exists in the Tenda AC1206 router's Web UI, allowing unauthenticated remote attackers to bypass security controls. The exploit is publicly available, increasing the risk of active exploitation and potential compromise.
CVE-2026-82693
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability exists in Tenda routers, allowing unauthenticated remote attackers to bypass authentication for the Web UI's Telnet function. Exploitation could lead to unauthorized access and control of the device. The exploit is publicly known, increasing risk.
CVE-2026-82860
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability in the @hulumi/policies library allows for bypassing administrator policy guardrails by crafting policy paths that circumvent evaluation. This could impact systems relying on these policies for access management. Uncertainty exists regarding how an attacker could reach and trigger this vulnerability.
CVE-2026-82859
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in hulumi's deployment SCP template can bypass security protections, potentially allowing unintended access changes to cloud resources. This issue could impact identity and access management boundaries in downstream deployments.
CVE-2026-82858
Halo Surface Signal: 3 out of 5 — possibly public-facing.
The @hulumi/drift technology, when accepting externally supplied execute plans without sufficient validation, presents a risk. Attackers can provide malicious plans that bypass security checks, potentially leading to unsafe reconciliation operations. It is important to determine if this technology is in use and if it p
CVE-2026-82857
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A privilege escalation vulnerability exists in hulumi's weekly integration IAM policy. If reachable, an attacker with documented principal access could create persistent, higher-privilege roles in sandbox accounts by performing role lifecycle operations without sufficient boundary restrictions.
CVE-2026-82856
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
This vulnerability affects the `@hulumi/policies` library, which fails to validate AWS IAM condition operators in GitHub OIDC trust policies. This allows attackers to potentially hide wildcard conditions and bypass security guardrails. The relevance and exposure of this library in your environment need to be confirmed.
CVE-2026-82855
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An evidence validation bypass vulnerability exists in `@hulumi/policies`, allowing attackers to circumvent security checks by submitting unrelated compliant evidence. This could weaken security guardrails for cloud resources, potentially leading to the deployment of insecure configurations. The relevance and exposure o
CVE-2026-19410
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An Incorrect Authorization vulnerability in Google Cloud Build's GitHub Trigger Comment Control allowed remote attackers to execute unreviewed code in the build environment via webhook suppression. This issue affects internal development and automation workflows, and while patched, understanding potential exposure is c
CVE-2026-58574
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Dell PowerStore systems have a critical vulnerability where missing authentication on a restricted management interface could allow an unauthenticated network attacker to read sensitive internal system information and credentials. Exploitation could lead to full administrative access to the storage array.
CVE-2026-77956
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in ash_ai allows unauthenticated attackers to execute arbitrary Elixir code on the server by manipulating prompt content, which is improperly evaluated as code before AI model requests are processed. This could lead to server-side code execution if prompt actions incorporate attacker-controlled data. It