NVD disclosure day
CVE-2026-8333
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A stored cross-site scripting vulnerability in the Microchip TimePictra platform could allow an authenticated, low-privileged attacker to inject malicious scripts. When other users view the affected pages, these scripts could execute, posing a risk. Confirming the platform's presence and exposure in your environment is
CVE-2026-12591
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An authenticated technician can exploit insufficient permission validation in ManageEngine M365 Manager Plus to escalate privileges, potentially leading to remote code execution. This vulnerability affects the delegated administration interface of the tool used for managing Microsoft 365.
CVE-2026-12507
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in ManageEngine products allowing authenticated users with reporting permissions to execute arbitrary commands on the server via specially crafted database queries. If reachable, this could lead to a compromise of the underlying system. The affected products are enterprise IT management and help
CVE-2026-76954
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical SQL injection vulnerability in Synology DiskStation Manager's Auth API allows remote attackers to read or write arbitrary files and cause denial-of-service attacks. This flaw affects internet-facing devices and poses a significant risk if unaddressed.