NVD disclosure day
CVE-2026-93328
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A critical vulnerability in the Google Cloud MCP Toolbox for Databases allows unauthenticated attackers to exfiltrate host files or overwrite local files via crafted parameters. This could lead to sensitive data exposure or system compromise. Confirmation of the tool's network exposure and business criticality is advis
CVE-2026-65184
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical command injection vulnerability exists in a root-privileged terminal-bridge daemon that processes client-supplied data without validation, potentially allowing unauthorized command execution. This issue is reachable via a network without authentication, posing a significant risk to system confidentiality, in
CVE-2026-59107
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability in the vSolution Matrix file sharing feature allows an attacker with a private key to gain root access via SSH on main/master stations with file sharing enabled. This could lead to unauthorized system control, impacting devices configured in this specific manner.
CVE-2026-59106
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the WolfProt interface allows unauthenticated attackers with network access to execute operating-system commands with the application's privileges due to insufficient input handling. This could impact the integrity and availability of the affected application service and underlying operating system.
CVE-2026-116485
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in danmu_api allows unauthenticated attackers to bypass authentication and modify server configurations when default tokens are in use. This could lead to unauthorized control and potential service disruptions. It is important to confirm if this technology is in use and assess its exposure.
CVE-2026-116214
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in MacCMS allows unauthenticated attackers to bypass authentication and reset any member's password due to an incomplete check in the password recovery function, potentially leading to account takeover and unauthorized access to associated data.
CVE-2026-115693
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability in hackney_ssl allows an on-path attacker to impersonate a server by using a certificate chain that ends in a publicly trusted root, even when the connection is pinned to a private certificate authority. This could lead to server impersonation and potential interception or manipulation of traffic.
CVE-2026-115188
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unrestricted file upload vulnerability exists in Mautic's campaign import feature, allowing authenticated users to place arbitrary files, including scripts, in a web-accessible directory. If exploited, this could lead to remote code execution and compromise of sensitive data. The primary concern is determining Mauti
CVE-2026-110475
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the CreditNirvana Collections Platform's login service allows unauthenticated attackers to access APIs and sensitive information by manipulating authentication requests. This could lead to user impersonation, including administrative access, and unauthorized data modification.
CVE-2026-107656
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An authentication bypass vulnerability in Fortinet FortiSandbox may allow attackers to execute unauthorized code or commands via crafted HTTP requests. This vulnerability could be exploited if the affected technology is reachable.
CVE-2026-107092
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
NexoPOS contains a directory traversal vulnerability in its `api/update` endpoint. This could allow an unauthenticated attacker to access or modify sensitive files on the server, potentially leading to unauthorized data disclosure or system compromise. It is important to confirm if NexoPOS is deployed and assess its ex