NVD disclosure day
CVE-2025-44148
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical cross-site scripting vulnerability in MailEnable could permit remote code execution by an attacker. This affects the failure.aspx component, and if reachable, could compromise system integrity. Understanding if MailEnable is used is crucial to assess potential risk.
CVE-2025-4517
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in the Python `tarfile` module allows arbitrary filesystem writes outside the extraction directory when processing untrusted archives with specific filter settings. This could enable attackers to overwrite or place files anywhere on the system. This issue is relevant if your environment uses the `tarfil
CVE-2025-21479
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A memory corruption vulnerability in Qualcomm chipsets could allow unauthorized command execution in the GPU micronode. This impacts organizations using affected devices and presents a risk of data compromise and system disruption. Applying vendor-provided mitigations is recommended.
CVE-2025-27038
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A memory corruption vulnerability impacts Qualcomm chipsets when rendering graphics in Chrome. This could lead to data corruption, affecting system integrity and posing a business risk to organizations utilizing affected hardware. Mitigation guidance is available from Qualcomm.
CVE-2025-21480
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
The vulnerability affects Qualcomm chipsets, allowing for memory corruption through unauthorized command execution. This poses a risk of compromised confidentiality, integrity, and availability of data and systems. The vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog.
CVE-2025-5419
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in web browsers may allow attackers to corrupt memory via a crafted web page, potentially affecting system data and operations. Organizations should identify and secure affected browsers to mitigate this risk.