NVD disclosure day
CVE-2026-104736
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
The LearnPress plugin for WordPress has a critical PHP object injection vulnerability that unauthenticated attackers can exploit via the checkout process. This flaw occurs because input from a request parameter is not properly handled before being unserialized, potentially allowing arbitrary PHP object injection. This
CVE-2026-110653
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A race condition vulnerability in a WordPress appointment booking plugin allows unauthenticated attackers to bypass authentication. If an attacker knows a customer's email or phone number, they can send concurrent requests to brute-force an OTP code and gain full access to the customer's account, bookings, and personal
CVE-2026-111823
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Mage OSS can create sessions with unknown OAuth providers, potentially allowing unauthorized access. This issue impacts system data and service behavior, and organizations should verify their use of Mage OSS and its external accessibility to assess and manage potential risks.