NVD disclosure day
CVE-2026-19117
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An attacker can register a malicious FIDO2 credential against a target account in on-premises deployments, enabling them to authenticate as that user and gain unauthorized access. This bypasses standard authentication controls.
CVE-2026-66786
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability exists in Submariner's cert-auth mode where unvalidated connection configurations can be exploited to inject arbitrary commands, potentially leading to remote code execution as root on gateway nodes. This occurs when a malicious cluster publishes a specially crafted CableName containing newline characte
CVE-2026-53671
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability exists in PREVAIL, an eBPF program verifier, where memory writes are improperly ignored, allowing crafted programs to bypass safety checks. This could result in unsafe eBPF programs being incorrectly flagged as secure, raising concerns about the integrity of verified programs. The issue is patched in ve
CVE-2026-53670
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in the PREVAIL eBPF verifier allows crafted programs to bypass security checks, potentially corrupting memory during runtime. This issue is present in versions prior to 0.2.4. The reader should care because memory corruption can lead to unpredictable behavior in systems that process eBPF programs.
CVE-2026-53649
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Joro's default proxy mode exposes an unauthenticated local API that allows cross-origin JavaScript to upload plugins and trigger restarts, leading to remote code execution as the operator's user. This vulnerability is reachable via a malicious webpage visit if the framework is running.
CVE-2026-20274
Halo Surface Signal: 3 out of 5 — possibly public-facing.
Cisco IOS XR Software has critical vulnerabilities related to improper resource control. If reachable, these flaws could allow an attacker to compromise the system, impacting network integrity and availability. It is important to confirm if affected technology is present and potentially exposed within your network.
CVE-2026-20212
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in Cisco Nexus 9000 Series Switches allows remote, unauthenticated attackers to execute code with root privileges. Exploitation is possible if TCP ports 43210 or 43211 are reachable, which could lead to device reloads and network service disruption. This impacts critical network infrastructure.
CVE-2026-78689
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in NGINX JavaScript's XML module allows unauthenticated remote attackers to cause denial of service through out-of-bounds writes, potentially leading to worker crashes or memory growth, and possibly code execution. This impacts NGINX configurations processing XML data, especially during SAML signature v
CVE-2026-53611
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability exists in the Looking Glass network diagnostic platform that could allow remote command execution. This occurs due to improper input validation. Confirming if this technology is in use and ensuring it is updated is important.
CVE-2026-82955
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An API Gateway component in a development version of Eclipse aeriOS contains a flaw where security for validating JSON Web Key Set (JWKS) information is disabled by default. This could allow an attacker to intercept communications and provide a malicious JWKS to compromise token validation. The vulnerability has been a
CVE-2026-77009
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in the WatchMan-Site7 WordPress plugin that allows authenticated users to execute arbitrary PHP code on the server by accessing its debugging console. This could lead to a compromise of the website and its data.
CVE-2026-4357
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A WordPress plugin allows unauthenticated attackers to upload PHP backdoors, potentially leading to full website compromise and arbitrary code execution. This vulnerability is reachable via the network and affects websites using the affected plugin.
CVE-2025-9314
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in the Developer Tools WordPress plugin that allows unauthenticated arbitrary file uploads. This could enable an attacker to upload malicious files, potentially leading to system compromise. Confirming the use and exposure of this plugin is important.
CVE-2026-73475
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An incorrect authorization flaw in Drupal Commerce PayPal could permit forceful browsing, potentially exposing sensitive payment and order data to unauthenticated attackers. This impacts e-commerce platforms using Drupal, necessitating verification of module usage and exposure.
CVE-2026-84795
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in Craft CMS allows attackers to gain administrator privileges by registering with a deactivated admin's email if public registration and disabled email verification are enabled. This could lead to unauthorized access and impact system integrity and availability.
CVE-2026-81294
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated privilege escalation vulnerability exists in the Authorizer technology. If reachable, an attacker could exploit this to gain unauthorized administrative control over a system. This could impact systems that rely on Authorizer for user access management.
CVE-2026-81286
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated SQL injection vulnerability exists in the WCFM Marketplace plugin. This flaw could allow attackers to inject malicious SQL, potentially leading to unauthorized access or modification of sensitive marketplace data. It is uncertain if this vulnerability is being actively exploited or what specific data
CVE-2026-78657
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The SigmaForms Pro WordPress plugin has a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server by exploiting insufficient file path validation in the submission file deletion function. This could lead to remote code execution if critical system files are targeted.
CVE-2026-9055
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability exists in the Amelia WordPress plugin, allowing unauthenticated attackers to escalate privileges to administrator. This is achieved by manipulating the customer update endpoint to elevate a user's role and overwrite administrator credentials, potentially leading to a complete website compromise
CVE-2026-84699
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Team Password Manager has a flaw in its local account password reset flow, allowing unauthenticated attackers to reset passwords and gain unauthorized access to user accounts. This vulnerability is reachable over the network, posing a risk to the sensitive credentials managed by the application. Confirming the use and
CVE-2026-84695
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
BookStack's drawing upload feature contains a stored cross-site scripting vulnerability that allows attackers with editor permissions to upload SVG files with embedded scripts. These scripts can execute in administrator browsers when accessed through the image gallery API, potentially impacting sensitive information. C
CVE-2026-84354
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Google Chrome has an authorization flaw in its FileSystem component that, if exploited, could allow remote attackers to execute arbitrary code outside the browser's sandbox. Exploitation requires a user to visit a malicious HTML page, indicating that user interaction is necessary for this threat to be realized. This vu
CVE-2026-84353
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Google Chrome on Android allows a remote attacker, through social engineering, to execute arbitrary code outside the sandbox via a crafted HTML page. This critical issue impacts device integrity and confidentiality when the browser is used. Uncertainty remains regarding exploitation me
CVE-2026-84352
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A use-after-free vulnerability in Google Chrome's WebGL component on Android could permit a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. This issue is rated Critical.
CVE-2026-84333
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Google Chrome on Android could allow remote attackers to execute arbitrary code outside the sandbox via a crafted HTML page. This could impact devices if users visit malicious websites, requiring confirmation of exposure and management of browser updates.
CVE-2026-84325
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Google Chrome's DataTransfer component could allow remote attackers to bypass system access restrictions by leveraging social engineering and a co-installed application. This could lead to unauthorized access or modification of system data if a user is tricked into interacting with a malicious link.
CVE-2026-84324
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Google Chrome's proxy allows a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. This could lead to code execution on the user's system. Confirmation is needed to determine if this client-side vulnerability affects the environment.