NVD disclosure day

Published threat advisories for October 8, 2026

CVE-2026-107459

Openfind SecuShare Pro OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

An OS Command Injection vulnerability exists in Openfind's SecuShare Pro, allowing unauthenticated remote attackers to execute arbitrary commands on the server. This could lead to unauthorized access and compromise of the system. Confirmation of its use within the organization is crucial to assess potential exposure.

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2026-17609

Super Forms Arbitrary Directory Deletion Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical vulnerability in the Super Forms WordPress plugin allows unauthenticated attackers to delete arbitrary directories, including the entire WordPress installation, if a specific, commonly enabled setting is active. This occurs due to insufficient validation during form submissions, posing a risk to server data

NVD modified: NVD date unavailable