NVD disclosure day
CVE-2025-34523
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A critical flaw in Arcserve UDP allows unauthenticated attackers to crash the service or possibly run their own code remotely, affecting data protection operations. Address this now to prevent disruption.
CVE-2025-34163
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An external attacker could run malicious code on servers running Dongsheng Logistics Software by uploading a crafted file. This could allow them to gain control of the system, potentially impacting sensitive logistics data and operations.
CVE-2025-34162
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An external attacker could steal sensitive patient data or bypass login for the Bian Que system, impacting critical emergency information and leading to unauthorized access.
CVE-2025-34161
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Coolify, a platform for managing application deployments, has a critical vulnerability enabling authenticated users with low-level privileges to execute arbitrary shell commands via the Git Repository field during project creation, potentially leading to full server compromise.
CVE-2025-34159
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Coolify versions prior to v4.0.0-beta.420.6 have a critical remote code execution vulnerability. Authenticated users with low-level privileges can inject malicious Docker Compose directives during project creation, potentially leading to full root access on the underlying server by mounting the host's filesystem. This
CVE-2025-34157
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Coolify, enabling low-privilege users to execute malicious scripts via crafted project names. This stored cross-site scripting flaw, when triggered by an administrator action, can lead to a full Coolify instance compromise, including the theft of sensitive data and access to managed s