NVD disclosure day
CVE-2025-61928
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in the Better Auth library allows unauthenticated attackers to create or modify API keys for any user. This bypasses authentication controls, enabling attackers to gain complete access to user accounts and potentially compromise sensitive data and application functions.
CVE-2025-59286
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A command injection vulnerability exists in Microsoft 365 Copilot chat, allowing an attacker to disclose information over a network. This issue stems from improper neutralization of special elements used in commands. Because Copilot is a web-based service accessed via the internet, this vulnerability presents a potenti
CVE-2025-59272
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Improper handling of command elements in Copilot Chat may allow an attacker to disclose local information. The reachability of this vulnerability is uncertain, as it appears to require local access.
CVE-2025-59252
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A command injection vulnerability in Microsoft 365 Word Copilot may allow an unauthorized attacker to disclose information over a network. The primary concern is to ascertain if this technology is deployed and assess any potential exposure.
CVE-2025-59247
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical elevation of privilege vulnerability exists in Azure PlayFab. Unauthenticated attackers can exploit this flaw over the network to gain elevated privileges, potentially impacting service integrity and availability. The platform is designed with public-facing APIs, increasing its exposure.
CVE-2025-59246
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability exists in Azure Entra ID that could allow an unauthenticated attacker to gain elevated privileges. This could impact the integrity and availability of the service, potentially leading to unauthorized actions. This issue is accessible via the network and requires confirmation of Entra ID's reach
CVE-2025-59218
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability in Azure Entra ID could allow an attacker to escalate privileges. An attacker could exploit this by tricking a user into interacting with malicious content, potentially leading to unauthorized access and modification of sensitive information or system configurations. This impacts the confidenti
CVE-2025-55321
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Azure Monitor contains a cross-site scripting flaw that could allow an attacker to impersonate users and display deceptive content. This is a concern because Azure Monitor is often internet-facing, making the vulnerability potentially reachable. This could impact users interacting with the monitoring interface, leading
CVE-2025-35051
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A critical vulnerability exists in Newforma Project Center Server that could allow unauthenticated attackers to execute arbitrary code. The affected endpoint is typically internal but, if reachable, could lead to compromised system data and behavior. Confirmation of internal network exposure and access controls is advi
CVE-2025-35050
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in Newforma Info Exchange permits unauthenticated remote attackers to execute arbitrary code, impacting Newforma Project Center Server. This allows for potential compromise of associated project data.
CVE-2025-59978
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A cross-site scripting vulnerability in Juniper Networks Junos Space allows an authenticated attacker to inject script tags into web pages. When viewed by another user, these scripts can execute, enabling the attacker to run commands with the victim's administrative privileges. This could lead to unauthorized control o
CVE-2025-11371
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Certain Gladinet CentreStack and TrioFox installations have a flaw allowing unauthorized system file disclosure. Exploitation has been observed, posing a risk to data confidentiality for affected organizations.
CVE-2025-59974
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A cross-site scripting vulnerability in Juniper Security Director allows for script injection, potentially executing in other users' browsers when they access affected pages. This could impact user sessions or data. The exact extent of risk depends on whether the technology is reachable and relevant within your environ
CVE-2025-10284
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability exists in BBOT's unarchive module, allowing for arbitrary file writes and potential remote code execution through specially crafted archive files. This issue could be relevant if the tool is in use within your environment.
CVE-2025-10283
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability in BBOT's gitdumper module allows for command execution through a malicious git repository. If reachable, this could lead to unauthorized command execution on a user's system. Confirming if BBOT is in use and assessing its usage is advised.
CVE-2025-11539
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Grafana Image Renderer has a critical vulnerability allowing remote code execution due to improper file path validation. If an attacker can reach the rendering endpoint and the authentication token is known, they can write files to arbitrary locations, potentially leading to code execution when loaded by the Chromium p
CVE-2025-11522
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the Search & Go - Directory WordPress Theme allows unauthenticated attackers to bypass authentication and take over any user account, including administrators, if Facebook login is enabled. This could expose sensitive data and compromise system access.
CVE-2025-7634
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in the WP Travel Engine WordPress plugin, enabling unauthenticated attackers to include and execute arbitrary PHP files on the server. This could lead to unauthorized data access or code execution. The concern is if this plugin is in use and accessible.
CVE-2025-7526
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The WP Travel Engine plugin for WordPress has a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution. This occurs due to insufficient file path validation in a function that handles user profile image uploads.
CVE-2025-10586
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection vulnerability exists in the Community Events WordPress plugin, allowing authenticated users to extract sensitive database information by manipulating a specific parameter. This issue is reachable on public-facing websites and poses a risk of unauthorized data access.