NVD disclosure day
CVE-2025-55754
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Improper neutralization of escape sequences in Apache Tomcat logs could allow an attacker to manipulate the console and clipboard. If an administrator views these logs on a compatible console, they could be tricked into running malicious commands. The specific attack vector is uncertain, but the potential for manipulat
CVE-2025-34292
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Rox, the software for BeWelcome, has a critical PHP object injection vulnerability from untrusted data deserialization. Attackers could achieve arbitrary file writes or remote code execution, potentially leading to full site compromise. This is reachable via web interactions and requires attention due to its critical i
CVE-2025-41009
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection vulnerability exists in the DRED virtual campus platform. An attacker can exploit this by sending a POST request to a specific endpoint, potentially allowing them to retrieve, create, update, or delete database information. This could compromise sensitive academic or user data stored within the platform
CVE-2025-59461
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A critical vulnerability exists in SICK industrial devices, allowing unauthenticated remote attackers to access or modify sensitive data and disrupt services. This could impact operational continuity if the affected technology is exposed on a network.
CVE-2025-62959
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical Improper Control of Generation of Code vulnerability exists in the Paid Videochat Turnkey Site software. This flaw could permit remote code inclusion, potentially allowing unauthorized code execution if the software is reachable. The reader should care to determine if this service is deployed within their en