NVD disclosure day
CVE-2025-4378
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in the ATA-AOF Mobile Application allows authentication abuse and bypass due to cleartext transmission of sensitive information and hard-coded credentials. This could expose sensitive data and compromise account access if the application is reachable and relevant.
CVE-2025-4383
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability in Wi-Fi Cloud Hotspot may allow authentication bypass or abuse. This issue could enable unauthorized access over the network. It is important to determine if this technology is deployed to assess any potential impact.
CVE-2025-32975
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in Quest's KACE Systems Management Appliance enables attackers to bypass authentication and impersonate users, potentially leading to administrative takeover of systems. This poses a business risk by compromising data and operational control. Organizations should prioritize applying vendor-supplied patc
CVE-2025-6433
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability exists where a webpage with an invalid TLS certificate can prompt a user to complete a WebAuthn challenge after the user bypasses a security warning. This violates the secure transport requirement for WebAuthn. The extent of affected products and data is currently uncertain.
CVE-2025-6427
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability allows attackers to bypass browser security policies by manipulating subdocuments, which could hide network connections from development tools. This issue, affecting Firefox and Thunderbird, has been addressed in newer versions. Confirming if your configurations were ever exposed is advisable.
CVE-2025-6424
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in Firefox's FontFaceSet component could allow an attacker to cause an exploitable crash by directing a user to malicious web content. This impacts application stability and potentially system security.
CVE-2025-34037
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An OS command injection vulnerability in Linksys routers allows unauthenticated attackers to execute arbitrary commands over HTTP. This could lead to unauthorized code execution on affected devices, impacting network security.