NVD disclosure day

Published threat advisories for September 22, 2025

CVE-2025-59434

Flowise Cloud Cross-Tenant Secrets Exposure

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

A vulnerability in Flowise Cloud's Custom JavaScript Function node allows authenticated free-tier users to access sensitive environment variables from other tenants, potentially exposing secrets like API keys and cloud credentials, leading to cross-tenant data exposure. This issue has been patched in the August 2025 up

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2025-58255

Custom Post Type Images Plugin CSRF Vulnerability Allows Code Injection.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

A Cross-Site Request Forgery vulnerability exists in the Custom Post Type Images plugin, enabling code injection. Attackers can exploit this by tricking authenticated users into performing unintended actions, potentially leading to unauthorized code execution and website compromise. Confirming the plugin's usage and as

NVD modified: NVD date unavailable