NVD disclosure day
CVE-2026-112005
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A path traversal vulnerability exists in WhoDB's query editor, allowing unauthenticated remote attackers to read and write arbitrary host files by leveraging DuckDB filesystem functions. This could enable the theft of sensitive data like session keys and credentials or the overwrite of critical files. The primary conce
CVE-2026-111998
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Vanus software contains a critical default credentials vulnerability. Unauthenticated remote attackers can gain cluster-admin access by using a hardcoded token to manage critical system resources and read or publish events, posing a significant risk to data and operations.
CVE-2026-110886
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A deserialization vulnerability in QuantumCloud Conversational Forms for ChatBot may allow object injection, potentially impacting service integrity and availability. This issue affects systems designed for user interaction, making it crucial to confirm if this technology is in use and exposed to understand potential r
CVE-2026-110372
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An incorrect privilege assignment vulnerability exists in the OttoKit plugin, enabling privilege escalation. If reachable, this flaw could allow unauthorized users to gain elevated access, potentially impacting system integrity and data. Confirming the use of this plugin and assessing its exposure is crucial.
CVE-2026-109894
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical SQL injection vulnerability in the Booktics plugin allows attackers to manipulate database queries. If reachable, this could lead to unauthorized access to or corruption of sensitive information stored in the application's database. Security teams should verify if this plugin is in use and assess potential e