NVD disclosure day
CVE-2025-12108
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
The Survision LPR Camera system has a vulnerability allowing unauthenticated access to its configuration wizard. This could permit unauthorized modification of camera settings if the system is reachable on a network. Identifying deployed instances and their network exposure is important.
CVE-2025-61956
Halo Surface Signal: 3 out of 5 — possibly public-facing.
Radiometrics VizAir has a vulnerability where critical functions can be modified without authentication. This could allow manipulation of runway settings and meteorological data, potentially misleading air traffic control and pilots. The impact hinges on whether the affected systems are reachable and relevant to your o
CVE-2025-61945
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Radiometrics VizAir systems are vulnerable to unauthenticated remote attackers who can access the admin panel. Attackers can then modify critical weather parameters, potentially disabling vital alerts and leading to hazardous conditions for aircraft or unsafe runway assignments.
CVE-2025-54863
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Radiometrics VizAir is affected by a critical vulnerability where a REST API key is exposed in a publicly accessible configuration file. This allows unauthenticated remote attackers to alter weather data, manipulate configurations, and cause denial-of-service, potentially disrupting airport operations and flight safety
CVE-2025-12682
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
The Easy Upload Files During Checkout WordPress plugin has a vulnerability that allows unauthenticated attackers to upload arbitrary JavaScript files. This could potentially enable remote code execution on the affected server. The primary concern is identifying if this plugin is in use and accessible online.
CVE-2025-12493
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in a WordPress plugin, allowing unauthenticated attackers to include and execute arbitrary PHP files on a server. This could lead to the disclosure of sensitive information or unauthorized code execution. The affected plugin is exposed to the internet by design as it enhances e-commerce
CVE-2025-12158
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A flaw in the Simple User Capabilities WordPress plugin allows unauthenticated attackers to elevate any user's role to administrator due to a missing capability check. This could lead to complete site control for an attacker. It is important to assess plugin usage and review access controls on affected WordPress sites.
CVE-2025-11008
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the CE21 Suite WordPress plugin allows unauthenticated attackers to access log files containing sensitive information, such as authentication credentials. This could lead to unauthorized access to user accounts, including administrators, potentially resulting in a complete website takeover. The reade
CVE-2025-11007
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The CE21 Suite plugin for WordPress has a critical vulnerability allowing unauthenticated attackers to update plugin settings, including a secret key. This enables them to create new administrator accounts, potentially leading to unauthorized site control. The issue is relevant due to its reachability via public-facing