NVD disclosure day

Published threat advisories for October 20, 2025

CVE advisoryCRITICAL

CVE-2025-12001

BLU-IC2 and BLU-IC4 application manifest sanitation flaw allows stored XSS.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A sanitation flaw in BLU-IC2 and BLU-IC4 devices allows for stored cross-site scripting by injecting malicious scripts into application manifests, potentially impacting sensitive data displayed through their interfaces. This vulnerability is reachable via the network and does not require authentication or special privi

NVD modified: NVD date unavailable
CVE advisoryCRITICAL

CVE-2025-9574

ABB ALS-mini IP Missing Authentication for Critical Function Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

ABB ALS-mini IP access control systems have a critical vulnerability allowing unauthenticated network access to sensitive functions. If reachable, this could lead to system compromise. Confirm if these devices are deployed and exposed to the network.

NVD modified: NVD date unavailable
CVE advisoryCRITICAL

CVE-2025-10678

NetBird VPN Default Admin Password Vulnerability

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

A vulnerability in NetBird VPN allows an attacker to gain administrative access if installed using the vendor's script, as a default admin account password was not removed or changed. This could lead to unauthorized control over the VPN service. Confirm your installation method and password security.

NVD modified: NVD date unavailable
CVE advisoryCRITICAL

CVE-2025-41028

Epsilon RH SQL Injection Vulnerability Allows Database Manipulation.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A SQL Injection vulnerability in Epsilon RH allows an attacker to manipulate database contents via a web service. If reachable, this could lead to unauthorized access and modification of sensitive information, impacting data integrity and confidentiality. Confirming the application's exposure and relevance in your envi

NVD modified: NVD date unavailable
CVE advisoryKnown Exploit

CVE-2025-61932

Lanscope Endpoint Manager Remote Code Execution Vulnerability.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

A vulnerability in Lanscope Endpoint Manager allows unauthorized code execution via specially crafted network requests. This could lead to compromised endpoint management systems, affecting organizational data and operations. The business risk involves potential unauthorized access and disruption.

NVD modified: NVD date unavailable • CISA KEV
CVE advisoryCRITICAL

CVE-2025-31342

Galaxy Software Services Vitals ESP Forum Module Unrestricted File Upload Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical vulnerability in a forum module allows authenticated users to upload malicious files and execute arbitrary system commands. This issue is a concern if the module is in use and accessible, as it could lead to significant system compromise.

NVD modified: NVD date unavailable
CVE advisoryCRITICAL

CVE-2025-11948

Excellent Infotek Document Management System Arbitrary File Upload Vulnerability.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical arbitrary file upload vulnerability exists in a document management system, allowing unauthenticated remote attackers to upload and execute web shells, leading to arbitrary code execution on the server. This could impact system data and services. The vulnerability is network-reachable.

NVD modified: NVD date unavailable