NVD disclosure day
CVE-2026-86304
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in a SAML authentication module allows bypassing security by processing forged assertions. This could lead to unauthorized access by enabling an attacker to impersonate users with a self-signed certificate. Confirming the use of this technology is crucial to understand potential exposure.
CVE-2026-86219
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in the Authen::SASL::Perl::DIGEST_MD5 library allows an attacker who observes an authentication exchange to replay captured responses, enabling them to impersonate a user without knowing their password. This could lead to unauthorized access if the affected library is used in network-facing services.
CVE-2026-19931
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A flaw in libcurl could enable a user's request to be sent over another user's previously authenticated HTTP connection when using Negotiate authentication with empty credentials and reusing a connection for the same hostname. This could potentially expose user session data or lead to incorrect requests being sent. The
CVE-2026-86259
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in OpenMAIC non-production builds allows unauthenticated attackers to bypass server-side request forgery validation, potentially exposing cloud credentials and metadata. Attackers can supply arbitrary provider URLs to access sensitive information. The primary concern is confirming relevance and exposure
CVE-2026-86218
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability exists in N-central, a remote monitoring and management platform, that allows for pre-authentication remote code execution. If an attacker can reach an exposed N-central instance over the network, they could execute arbitrary code without needing any credentials. This could impact the integrity
CVE-2026-75816
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in the Frontend Admin by DynamiApps WordPress plugin allows unauthenticated attackers to bypass security checks and take over any user account, including administrator accounts, by overwriting their email addresses and initiating a password reset. This issue affects all versions of the plugin u
CVE-2026-16310
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The MemberDash WordPress plugin has an Insecure Direct Object Reference vulnerability that allows unauthenticated attackers to reset any user's password and take over accounts. This impacts user registration and password management, potentially leading to unauthorized access and control of WordPress sites.
CVE-2026-86153
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Tenda CP3 devices, specifically within the privilege management functions. This issue could allow remote attackers to manipulate system settings and potentially compromise the device when accessed over the network. The relevance and exposure of this technology within your environment
CVE-2026-86152
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in Tenda CP3 devices allows remote attackers to inject operating system commands through a flaw in a Wi-Fi function. This could enable unauthorized control of the device's system. It is important to determine if this technology is in use and assess its exposure.
CVE-2026-86151
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in Tenda network configuration management that allows remote attackers to inject OS commands. This could impact device configuration and network behavior if exploited. Its relevance and potential exposure to our systems require confirmation.