NVD disclosure day
CVE-2025-8044
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Memory safety bugs were found in Firefox and Thunderbird, with evidence of memory corruption that could potentially be exploited for arbitrary code execution. These vulnerabilities have been fixed in later versions.
CVE-2025-8043
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability exists in Firefox and Thunderbird due to improper URL truncation handling, potentially allowing unauthorized data access or modification. This flaw could be triggered by user interaction with malicious content, impacting sensitive information. It is uncertain what specific data or business impa
CVE-2025-8038
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability exists in Thunderbird and Firefox where path validation for frame navigations was ignored, potentially allowing unauthorized actions. If reachable, this could affect user trust and data integrity. Confirm relevance and manage exposure.
CVE-2025-8037
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Firefox and Thunderbird allowed for the shadowing of cookies, potentially leading to unintended data exposure and session hijacking. This issue could occur when a specifically crafted, nameless cookie with an equals sign in its value is set, even if the shadowed cookie is secure. The impact involves
CVE-2025-8031
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Firefox and Thunderbird could expose HTTP Basic Authentication credentials if they are embedded within URLs in Content Security Policy reports. This occurs when the software fails to properly strip the `username:password` portion from these URLs, potentially leading to sensitive information disclosur
CVE-2025-8028
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in WebAssembly processing within Firefox and Thunderbird on arm64 architectures could lead to incorrect branch address calculations, potentially disrupting program execution. This issue has been addressed in updated software versions.
CVE-2025-4285
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An SQL injection vulnerability in Agentis allows attackers to manipulate database queries by sending specially crafted input over the network. This could lead to unauthorized access, modification, or denial of service, impacting data integrity and confidentiality. The risk exists if Agentis is deployed and accessible.
CVE-2025-38352
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A Linux kernel vulnerability allows for a race condition affecting POSIX CPU timers. This can lead to system instability and data corruption if an exiting task is concurrently managed by timer functions. Organizations should address this to mitigate business risk.