NVD disclosure day
CVE-2025-12553
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in email server software that disables certificate verification, potentially allowing unauthenticated attackers to compromise email server confidentiality, integrity, and availability. This could enable man-in-the-middle attacks or communication with malicious servers, risking sensitive informati
CVE-2025-6520
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical SQL injection vulnerability exists in Abis Technology BAPSIS, potentially allowing attackers to manipulate databases and access sensitive information. This issue could enable unauthorized data access and modification if an attacker can send specially crafted data over the network to a vulnerable instance. Or
CVE-2025-8489
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability exists in a WordPress plugin that, if reachable, could allow unauthenticated attackers to register as administrators, potentially leading to full website compromise. This issue arises from improper role restrictions during user registration, making it a significant concern for website security. Confirmi
CVE-2025-5397
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An authentication bypass vulnerability exists in the Noo JobMonster WordPress theme. If social login is enabled, unauthenticated attackers could bypass login procedures to access administrative accounts. This issue is relevant for WordPress sites using this theme with social login configured.
CVE-2025-52665
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A misconfiguration in the UniFi Access application's management API could allow unauthorized access if an attacker is already on the management network, potentially impacting the confidentiality and integrity of access control systems.
CVE-2025-48983
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability exists in Veeam Backup & Replication's Mount service, potentially allowing an authenticated domain user to execute arbitrary code remotely on backup infrastructure hosts. This could impact the integrity and availability of backup data and services. Readers should confirm if this technology is in use and