NVD disclosure day
CVE-2025-11832
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Azure Access Technology BLU-IC2 and BLU-IC4 are susceptible to a vulnerability that allows for resource exhaustion through flooding when reachable over a network. This could disrupt access control functions. The relevance depends on whether these technologies are deployed and exposed within the environment.
CVE-2025-62410
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in happy-dom allows untrusted JavaScript to execute in the same environment as the application, enabling prototype pollution attacks that can hijack critical references or control flow. This incomplete fix for a prior vulnerability means attackers could compromise application integrity. Identification a
CVE-2025-20359
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in Cisco Snort 3's HTTP decoder could permit an unauthenticated attacker to cause a denial of service by crashing the detection engine or to disclose sensitive data through specially crafted HTTP packets.
CVE-2025-53521
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in F5 BIG-IP Access Policy Manager allows for remote code execution when specific malicious traffic is processed. This flaw enables unauthorized actors to gain control of affected systems, posing a risk of data compromise and business disruption. Organizations should prioritize assessing their exposure
CVE-2025-9967
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in the Orion SMS OTP Verification WordPress plugin allows unauthenticated attackers to take over accounts by changing passwords without proper identity validation, provided they know the user's phone number. This could impact user access and data integrity on internet-exposed systems using the
CVE-2025-10294
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The OwnID Passwordless Login plugin for WordPress has an authentication bypass vulnerability. If the plugin is not fully configured, unauthenticated attackers could log in as any user, including administrators. This issue is relevant to WordPress sites using this plugin for authentication.
CVE-2025-10041
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in the Flex QR Code Generator WordPress plugin, allowing unauthenticated attackers to upload arbitrary files. This could enable remote code execution on the affected server, posing a significant security risk.
CVE-2025-39975
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in the Linux kernel's SMB client can mishandle command responses due to incorrect index referencing, potentially causing out-of-bounds memory access. This affects how command results are processed. Uncertainty exists regarding the exploitability and business impact of this issue.
CVE-2023-7305
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
SmartBI business intelligence software has an unrestricted file upload vulnerability in its RMIServlet. Attackers can exploit this to execute arbitrary code on the host system, a flaw for which a fix has been released and which is actively being exploited.