NVD disclosure day

Published threat advisories for May 5, 2025

CVE-2025-4318

AWS Amplify Studio UI Component Property Injection Vulnerability

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

A vulnerability exists in AWS Amplify Studio's UI component property handling, potentially allowing authenticated users to execute arbitrary JavaScript code during build processes. This impacts the security of developer tools and the software supply chain, requiring confirmation of internal exposure.

NVD modified: NVD date unavailable

CVE advisoryKnown Exploit

CVE-2025-27920

Output Messenger Directory Traversal Vulnerability.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A directory traversal vulnerability in Output Messenger allows attackers to access sensitive files outside intended directories. This impacts organizations by enabling unauthorized access to configuration details and other critical data, posing a significant business risk.

NVD modified: NVD date unavailable • CISA KEV