NVD disclosure day
CVE-2026-125384
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A default credentials vulnerability exists in INDOTALENT WHMS, allowing unauthenticated attackers to gain administrator access by using a known username and password. If default credentials remain unchanged, attackers can achieve full control over affected deployments, potentially compromising system and user data and
CVE-2026-125383
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical authentication bypass vulnerability exists in the INDOTALENT WHMS system, allowing unauthenticated attackers to forge security tokens and gain administrator access to the API. This is due to hard-coded JWT signing keys in the application's configuration. This issue impacts the system's integrity and availabi
CVE-2026-125370
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Kubero software has an authentication bypass vulnerability allowing unauthenticated remote attackers to forge administrative JWTs using a hardcoded secret. This could enable attackers to gain control of pipelines, applications, and user access.