NVD disclosure day
CVE-2026-86149
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in Tenda CP3 security cameras allows remote attackers to inject operating system commands. This issue arises from the way the device processes file inputs, potentially leading to unauthorized control and impact on device integrity. Confirmation of deployment and assessment of exposure are key c
CVE-2026-86148
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in Tenda CP3 cameras, allowing remote attackers with authentication to inject OS commands via a specific URL argument. This could lead to unauthorized actions on the device. It is uncertain if this technology is deployed or reachable, necessitating verification of its presence and relevance.
CVE-2026-86060
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical flaw in RouterOS's SSH login process allows unauthenticated attackers to escalate privileges by altering trusted security policies. This vulnerability requires an unauthenticated SSH session to reach the login helper. Readers should care because it impacts network router security and could lead to unauthoriz
CVE-2026-67279
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in MikroTik RouterOS allows unauthenticated access to execute commands, potentially leading to unauthorized file manipulation, including configuration and diagnostic data. This issue affects the SSH service and could impact network device integrity.
CVE-2026-67277
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
MikroTik RouterOS has a vulnerability where an unauthenticated connection can trigger an IPv4 UDP test, potentially exposing kernel memory and causing a denial of service by restarting the system's kernel. This affects network edge devices and requires attention from network infrastructure teams.
CVE-2026-67276
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability exists in RouterOS that allows an attacker to bypass SSH authentication. This flaw involves an incomplete comparison of RSA public keys during authentication, potentially enabling an attacker to impersonate a legitimate user and gain command-line access without the private key. Its relevance depends on
CVE-2026-86190
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A broken access control vulnerability in WWBN AVideo allows unauthenticated access to complete user records, including password hashes and session identifiers. Attackers could exploit this to hijack viewer sessions, including administrator accounts, and access sensitive personal data.
CVE-2026-86189
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A path traversal vulnerability in WWBN AVideo's notification script allows unauthenticated attackers to write files to arbitrary server locations. This occurs by exploiting a weakness in how security tokens are handled, enabling attackers to bypass authentication and potentially overwrite application files or inject ma
CVE-2026-86184
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An authentication bypass vulnerability exists in Lara Dashboard's screenshot-login route, allowing unauthenticated attackers to impersonate any user via email if the application is not in a production environment. This could lead to unauthorized access to administrative functions, database contents, and potential arbit
CVE-2026-10196
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability exists in the Mail Mint WordPress plugin, allowing unauthenticated attackers to inject PHP objects. This could lead to code execution on the server, potentially compromising the site. It is important to confirm if this plugin is in use and reachable to assess the risk to your online presence.
CVE-2026-86124
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
AutoAgent's TCP server contains a critical vulnerability that allows unauthenticated remote code execution. Attackers can exploit this by connecting to an exposed port and executing arbitrary commands as root within the container, potentially gaining access to sensitive host data. This issue requires immediate attentio
CVE-2026-86123
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
SQL Chat's unauthenticated API endpoints permit attackers to execute arbitrary SQL queries against specified hosts, enabling access to internal databases and network pivoting. This could expose sensitive data and allow unauthorized actions within a connected network.
CVE-2026-86121
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Cua computer-server, allowing unauthenticated attackers to execute arbitrary commands and access files by exploiting a failure to check authentication when a specific environment variable is unset and the server binds to all interfaces by default. This could enable attackers to run sh
CVE-2026-86119
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Webstudio contains a server-side request forgery vulnerability in its CGI proxy routes, allowing unauthenticated attackers to supply arbitrary URLs. This could lead to the exposure of cloud instance metadata and access to internal services, enabling network reconnaissance. It is uncertain if this technology is in use o
CVE-2026-86117
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An authentication bypass vulnerability exists in Coolify's OAuth callback handler, allowing attackers to gain access to user accounts by associating a victim's email with an attacker-controlled OAuth provider. This bypasses password and two-factor authentication requirements, potentially leading to unauthorized account
CVE-2024-11080
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the Post Grid and Gutenberg Blocks – ComboBlocks WordPress plugin allows unauthenticated attackers to inject arbitrary actions. If reachable and no other security controls are present, this could compromise the integrity and availability of the WordPress site. Organizations should identify affected s
CVE-2026-78362
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in the SEO Flow by LupsOnline WordPress plugin that allows unauthenticated users to take over a website if the plugin is configured. Attackers can exploit this by sending unvalidated API requests to gain administrative control. This necessitates confirming if the plugin is in use and exp
CVE-2026-83627
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the Hummingbird WordPress plugin could allow unauthenticated attackers to execute arbitrary PHP code. This occurs because a security check is bypassed, allowing malicious code to be written into a web-accessible log file if specific debug logging settings are enabled. This could lead to a full websit
CVE-2026-13447
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The Mstore Api plugin for WordPress has a critical vulnerability where missing cryptographic signature verification allows unauthenticated attackers to forge authentication tokens. This enables them to impersonate any phone number, potentially leading to unauthorized access to existing accounts or the creation of new o
CVE-2026-52777
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An authenticated PHP object injection vulnerability exists in YesWiki prior to version 4.6.6, allowing attackers to inject objects via BazarImportAction. This could lead to unauthorized code execution and compromise of system and user data. Administrators should confirm if their YesWiki instances are affected and apply
CVE-2026-52766
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the YesWiki system allows any user with write access to permanently delete arbitrary wiki pages due to a missing authorization check in the comment erasure action. This could lead to the loss of critical information, including administrative and user-owned content. The issue has been addressed in ver