Halo Threat Intelligence

Internet-Facing CVE Threat Intelligence

Prioritize newly modified vulnerabilities with Halo Surface Signal, known-exploit context, and remediation-focused advisories.

Latest threat feed

Top 10 advisories with Halo Signal 5 or CISA KEV status, ordered by the latest NVD modification.

CVE advisoryCRITICAL

CVE-2026-16340

IBM DataPower Gateway RFC2047 Parser Out-of-Bounds Write Vulnerability

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

A flaw in IBM DataPower Gateway's RFC2047 parser could permit remote attackers to execute arbitrary code. As these gateways often face the internet and manage essential traffic, this vulnerability presents a notable risk. It is crucial to verify if your organization utilizes affected versions to evaluate potential busi

NVD modified:

CVE advisoryCRITICAL

CVE-2025-59247

Azure PlayFab Elevation of Privilege Vulnerability

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

A critical elevation of privilege vulnerability exists in Azure PlayFab. Unauthenticated attackers can exploit this flaw over the network to gain elevated privileges, potentially impacting service integrity and availability. The platform is designed with public-facing APIs, increasing its exposure.

NVD modified:

CVE advisoryCRITICAL

CVE-2025-6553

Ovatheme Events Manager Arbitrary File Upload Vulnerability

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

The Ovatheme Events Manager WordPress plugin has a critical vulnerability allowing unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution. This issue is relevant to public-facing websites that use the plugin for event management and checkout processes.

NVD modified:

CVE advisoryCRITICAL

CVE-2025-59246

Azure Entra ID Authentication Bypass Vulnerability.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

A critical vulnerability exists in Azure Entra ID that could allow an unauthenticated attacker to gain elevated privileges. This could impact the integrity and availability of the service, potentially leading to unauthorized actions. This issue is accessible via the network and requires confirmation of Entra ID's reach

NVD modified:

CVE advisoryCRITICAL

CVE-2025-59218

Azure Entra ID Privilege Escalation Vulnerability

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

A critical vulnerability in Azure Entra ID could allow an attacker to escalate privileges. An attacker could exploit this by tricking a user into interacting with malicious content, potentially leading to unauthorized access and modification of sensitive information or system configurations. This impacts the confidenti

NVD modified:

CVE advisoryCRITICAL

CVE-2026-103646

Ultimate Multisite WordPress Unauthenticated Account Takeover

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

A critical vulnerability in the Ultimate Multisite WordPress plugin allows unauthenticated attackers to take over any user account, including administrators, by knowing the target's email address. This occurs due to improper handling of logged-out checkouts and customer lookups. The issue is externally exposed and requ

NVD modified:

CVE advisoryCRITICAL

CVE-2025-10850

Felan Framework WordPress Plugin Hardcoded Password Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

The Felan Framework plugin for WordPress has a critical authentication bypass vulnerability due to hardcoded passwords in its social login functions. This allows unauthenticated attackers to log in as any user who registered via Facebook or Google without changing their default password.

NVD modified:

CVE advisoryCRITICAL

CVE-2025-13764

WP CarDealer Plugin Privilege Escalation via Role Manipulation

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

The WP CarDealer WordPress plugin contains a privilege escalation vulnerability that allows unauthenticated attackers to gain administrator access by assigning themselves the administrator role during registration. This could lead to unauthorized control over the entire website.

NVD modified: