NVD disclosure day
CVE-2025-59545
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in the DNN (DotNetNuke) web content management platform's Prompt module that allows for the execution of raw HTML through malicious input, potentially leading to script execution. This issue affects versions prior to 10.1.0. Because the platform is often publicly accessible, this vulnerability co
CVE-2025-9900
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A flaw in Libtiff allows attackers to write data to arbitrary memory locations by providing a specially crafted TIFF image, potentially leading to code execution or denial of service. This vulnerability is reachable through user interaction with a malicious image file.
CVE-2025-9846
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in Inka.Net allows command injection through unrestricted file uploads. An attacker could exploit this remotely by uploading a malicious file, potentially leading to arbitrary command execution on the affected system. This issue poses a significant risk due to its critical severity.
CVE-2025-9962
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A buffer overflow vulnerability in Novakon P series devices allows unauthenticated attackers to gain root permissions when reachable over a network. This could impact device operational integrity and control functions, necessitating an inventory and risk assessment of deployed devices.
CVE-2025-10412
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in a WordPress e-commerce plugin allows unauthenticated attackers to upload arbitrary files to the server. If reachable, this could lead to remote code execution on the affected site. Security-aware leaders should confirm if this plugin is in use within their environment to assess potential exposure.
CVE-2025-10147
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The Podlove Podcast Publisher plugin for WordPress has a vulnerability that allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution. This issue is reachable by anyone accessing a public WordPress website using the affected plugin.
CVE-2025-9588
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An OS Command Injection vulnerability exists in Iron Mountain's EnVision archiving service, potentially allowing attackers to execute unauthorized commands on affected systems. This could impact confidentiality, integrity, and availability. Determining if this technology is in use and assessing its network exposure is
CVE-2025-9321
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The WPCasa WordPress plugin has a code injection vulnerability due to insufficient input validation, allowing unauthenticated attackers to execute arbitrary code. This could impact the integrity and availability of WordPress sites.
CVE-2025-26399
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
SolarWinds Web Help Desk is affected by a vulnerability allowing unauthenticated attackers to execute commands remotely. This could lead to unauthorized access and control of host machines, posing a significant business risk.