NVD disclosure day
CVE-2023-43000
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A memory corruption vulnerability in Apple products can allow attackers to impact system stability and potentially execute unauthorized code. This affects organizations using Safari, macOS, iOS, and iPadOS. The realistic business risk includes potential data compromise and operational disruption.
CVE-2025-56231
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Tonec Internet Download Manager has a critical vulnerability where it fails to validate SSL certificates during updates. This weakness could allow an attacker to bypass update protections, potentially leading to the delivery of malicious updates if the software's update process is triggered and reachable. This matters
CVE-2025-45378
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Dell CloudLink contains a vulnerability that allows a privileged user with known credentials to gain unauthorized system access by breaking into the command shell via SSH, potentially leading to elevated privileges and system compromise.
CVE-2025-20358
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A critical vulnerability in Cisco Unified Contact Center Express Editor allows unauthenticated attackers to bypass authentication and gain administrative permissions. This could lead to the creation and execution of arbitrary scripts on the affected server, impacting operations.
CVE-2025-20354
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in Cisco Unified Contact Center Express's Java RMI process allows unauthenticated, remote attackers to upload arbitrary files and execute commands as root. This could lead to system compromise and unauthorized access to sensitive data. It is important to confirm product relevance and assess exposure.
CVE-2025-47151
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A type confusion vulnerability in Entr'ouvert Lasso could allow an attacker to execute arbitrary code by sending a specially crafted SAML response. This could impact systems that rely on Lasso for identity federation. Uncertainty exists regarding whether our environment uses this software and if it is reachable.
CVE-2025-55108
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
The Control-M/Agent is vulnerable to unauthenticated remote code execution and unauthorized file access when mutual SSL/TLS authentication is not enabled. This occurs when documented security best practices, such as configuring SSL/TLS, are not followed. Control-M SaaS environments are not impacted by this vulnerabilit
CVE-2025-12674
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The KiotViet Sync WordPress plugin has a critical vulnerability that allows unauthenticated attackers to upload arbitrary files to a server, potentially enabling remote code execution. This issue affects all versions up to and including 1.8.5 and is reachable over the network.
CVE-2025-11749
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in the AI Engine WordPress plugin that can expose sensitive bearer tokens via its REST API when a specific feature is enabled. This exposure allows unauthenticated attackers to potentially gain access to valid sessions, which could lead to privilege escalation and unauthorized administrative cont
CVE-2025-12735
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A critical vulnerability exists in the expr-eval JavaScript library, which parses and evaluates mathematical expressions. Insufficient input validation allows an attacker to trigger arbitrary code execution by providing a crafted context to the `evaluate()` function. This could impact system integrity and availability