NVD disclosure day
CVE-2026-97229
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
GitLab has a critical vulnerability where unauthenticated users can execute arbitrary code on the server through a specially crafted regular expression in CI/CD configurations. This issue could impact the integrity and availability of GitLab servers and their data.
CVE-2026-89111
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A Server-Side Request Forgery (SSRF) vulnerability in the SAP Cloud SDK for Python allows an attacker to redirect OAuth2 token requests to an attacker-controlled server. This could lead to the exfiltration of client credentials, impacting multi-tenant BTP applications.
CVE-2026-89110
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in SAP NetWeaver Visual Composer's authorization checks allows low-privilege attackers to invoke internal operations on remote systems, potentially leading to full compromise and high impact on confidentiality, integrity, and availability.
CVE-2026-89108
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
SAP Manufacturing Integration and Intelligence has a flaw in its administrative functions where authorization is not properly enforced. An authenticated MII administrator could exploit this by submitting a crafted request to create an account with higher privileges on the Java application server. This could lead to an
CVE-2026-89107
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
SAP S/4HANA rule processing allows an authenticated attacker with specific privileges to submit crafted input that executes arbitrary ABAP code, potentially leading to full system compromise and impacting confidentiality, integrity, and availability. It is uncertain if the affected functionality is reachable or relevan
CVE-2026-87689
Halo Surface Signal: 3 out of 5 — possibly public-facing.
The Metasploit Framework Web Service REST API contains a vulnerability that allows unauthenticated access to stored credentials, including passwords and private keys. If reachable, an attacker could modify or delete this sensitive data, potentially compromising team engagements. Confirming the deployment and security o
CVE-2026-96119
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An authenticated attacker could exploit an improper data sanitization flaw in the IBM i HTTP Server Administration web application to disclose sensitive information or execute arbitrary code. This vulnerability may impact systems where the administration application is accessible.