NVD disclosure day

Published threat advisories for October 28, 2025

CVE advisoryCRITICAL

CVE-2025-36386

IBM Maximo Authentication Bypass Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical vulnerability exists in IBM Maximo Application Suite that allows remote attackers to bypass authentication and gain unauthorized access. This issue could lead to sensitive data exposure or system disruption. Owners of this asset management software should identify all instances, confirm exposure, and plan re

NVD modified: NVD date unavailable
CVE advisoryCRITICAL

CVE-2025-12380

Firefox WebGPU Sandbox Escape Vulnerability

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

A use-after-free vulnerability in Firefox allows a compromised child process to escape its sandbox via WebGPU inter-process calls, potentially affecting the GPU or browser process. This could lead to broader system compromise if exploited via a malicious website.

NVD modified: NVD date unavailable