NVD disclosure day
CVE-2025-48928
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in the TeleMessage service may expose passwords sent over HTTP. Exploited in May 2025, this affects organizations by potentially compromising credentials and systems. The realistic business risk involves unauthorized access to sensitive data due to the exposure of password information within the service
CVE-2025-48927
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The TeleMessage service has a vulnerability in its Spring Boot Actuator that exposes a heap dump endpoint. This allows unauthorized access to sensitive information, posing a risk to affected organizations and their data. The vulnerability was exploited in May 2025.
CVE-2025-45343
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Tenda W18E devices, allowing unauthenticated attackers to execute arbitrary code via the account module's editing functionality. If reachable, this could impact device functions and routed services, making it important to verify if these devices are in use within your organization.