Threat Advisories - NVD Disclosed September 4, 2025

CVE-2025-55241

Azure Entra ID Authentication Bypass Leading to Privilege Escalation

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

A critical vulnerability exists in Azure Entra ID, a cloud-based identity and access management service. This flaw could allow an unauthenticated attacker to gain elevated privileges, potentially leading to unauthorized access and modification of sensitive information. The vulnerability is reachable via network access

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2025-55190

Argo CD API Tokens Expose Repository Credentials

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A vulnerability in Argo CD allows API tokens with project-level permissions to retrieve sensitive repository credentials, even without explicit secrets access. This could lead to unauthorized disclosure of sensitive information if an attacker can reach the affected API endpoint with a low-privilege token. Argo CD's rol

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2025-54914

Azure Networking Elevation of Privilege Vulnerability.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical elevation of privilege vulnerability exists in Microsoft Azure Networking. If reachable, an unauthenticated attacker could exploit this to gain elevated privileges, potentially compromising system integrity and confidentiality. This impacts core cloud infrastructure, requiring assessment of reachability and

NVD modified: NVD date unavailable

CVE advisoryKnown Exploit

CVE-2025-48543

Android Sandbox Escape Leading to Privilege Escalation.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

A vulnerability in Android allows attackers to escape the Chrome sandbox, potentially leading to local privilege escalation on affected systems. This could impact core Android components and grant attackers elevated access without needing further privileges or user interaction. Organizations should identify affected sy

NVD modified: NVD date unavailable • CISA KEV