NVD disclosure day
CVE-2026-90647
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability exists in communication testing software that allows a network attacker to bypass certificate validation, enabling Man-in-the-Middle attacks on protected communications. This could impact the confidentiality and integrity of sensitive data.
CVE-2026-90558
Halo Surface Signal: 3 out of 5 — possibly public-facing.
sngrep, a tool for monitoring SIP traffic, has stack buffer overflow vulnerabilities. Attackers can craft malicious SIP packets with oversized header values to overflow buffers, potentially causing crashes or enabling arbitrary code execution. You should care because this could affect the integrity of SIP packet data,
CVE-2026-78159
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability in The Events Calendar WordPress plugin allows unauthenticated attackers to execute code on the server. This occurs due to insufficient validation of widget classes, potentially triggered by specially crafted comments on posts when comments are enabled. The ability for an attacker to run their
CVE-2026-78006
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The Events Calendar plugin for WordPress has a critical vulnerability that allows unauthenticated attackers to execute arbitrary code on the server. This is possible through specially crafted comments on event pages when comments are enabled and visible, by bypassing security checks during widget rendering.
CVE-2026-85681
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A WordPress plugin lacks proper security checks, allowing unauthenticated attackers to alter any site option. This could lead to a complete website takeover by enabling administrator registration.
CVE-2026-84171
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A WordPress plugin vulnerability allows unauthenticated attackers to upload arbitrary files to public directories, potentially leading to arbitrary code execution and server compromise. This issue impacts web application integrity and availability.
CVE-2026-82845
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in the Masteriyo LMS WordPress plugin allows authenticated users to inject PHP objects, potentially leading to arbitrary code execution on the server. A less severe version of this flaw, reachable without an account, can result in arbitrary file writes. The issue stems from the plugin's failure
CVE-2026-81402
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The DS Ad Rotator WordPress plugin contains a critical vulnerability that permits unauthenticated attackers to upload arbitrary files, including PHP scripts, to a web-accessible directory. This flaw, stemming from a lack of capability checks, nonce verification, and file-type validation, can enable remote code executio
CVE-2026-77006
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A WordPress plugin flaw allows any authenticated user to delete arbitrary server files by bypassing validation and security checks, potentially leading to a complete website takeover. This issue is reachable and relevant for internet-facing websites using the affected plugin.
CVE-2026-77005
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in a WordPress plugin allows any authenticated user to delete arbitrary server files due to insufficient path validation and capability checks, potentially leading to a site takeover.
CVE-2026-75800
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability exists in the Frontegg SAML SSO WordPress plugin, allowing unauthenticated attackers to log in as any user or create new accounts by bypassing signature and issuer validation. This could lead to unauthorized access and control of user accounts, including administrative privileges, on affected W
CVE-2026-87719
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
GitLab's Duo Chat feature contains a vulnerability that may allow an authenticated user to obtain sensitive instance configurations and credentials. This occurs when a specially crafted GraphQL subscription argument bypasses serialization, enabling server object lookup. This issue is relevant if your organization uses
CVE-2026-85706
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
GitLab instances are affected by a path traversal vulnerability in the repository commits API that can allow unauthenticated users to read arbitrary files from the server. This could lead to unauthorized disclosure of sensitive data, making it important to assess the exposure and business criticality of all deployed Gi