NVD disclosure day
CVE-2026-101084
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in obot that allows authenticated users to bypass access controls on the /mcp-connect endpoint. This could enable attackers to access and manipulate sensitive backend systems using stored credentials.
CVE-2026-88772
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability in Citrix NetScaler ADC and Gateway may permit unauthenticated remote code execution or denial of service. This flaw could impact critical network access and services if affected systems are internet-facing and unpatched, potentially disrupting operations.
CVE-2026-100741
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in hMailServer allows unauthenticated attackers to run arbitrary JScript with service account privileges. This requires specific, non-default event scripting configurations to be enabled, but exploitation can occur through specially crafted passwords or server responses. The main concern is con
CVE-2026-100835
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Contrast's remote attestation process is vulnerable to relay attacks, potentially allowing an attacker to impersonate trusted components and bypass identity verification. This occurs because the system may accept attestation reports without verifying the originating hardware. The vulnerability impacts Contrast's attest