NVD disclosure day
CVE-2025-10230
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability in Samba's WINS hook handling allows remote command execution as the Samba process via unsanitized NetBIOS names in registration packets. This could impact the integrity and availability of the domain controller and its services. Confirm if your environment uses this Samba functionality and is exposed.
CVE-2025-3222
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An improper authentication vulnerability in GE Vernova Smallworld allows for authentication abuse. If reachable, this could permit unauthorized access and misuse of the system's functions. The potential impact on system data and service behavior is dependent on the specific deployment.
CVE-2025-52425
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An SQL injection vulnerability in QuMagie, a photo management application, allows remote attackers to execute unauthorized code or commands. This could lead to unauthorized access or control, impacting system or user data and potentially exposing sensitive information.
CVE-2025-34299
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability in Monsta FTP allows unauthenticated attackers to upload arbitrary files and execute code, potentially leading to server compromise. This flaw enables attackers to upload malicious files from a malicious SFTP server, allowing for arbitrary code execution. Readers should assess their exposure an
CVE-2025-10870
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection vulnerability exists in DIAL's CentrosNet, allowing unauthenticated attackers to manipulate databases via web requests. This issue could permit unauthorized retrieval, creation, modification, or deletion of data. Understanding if CentrosNet is in use and externally accessible is crucial for assessing ri
CVE-2025-12352
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in the Gravity Forms WordPress plugin allows unauthenticated attackers to upload arbitrary files to a server, potentially leading to remote code execution. This affects sites with specific configurations including enabled post creation forms and file upload fields, and the `allow_url_fopen` setting enab
CVE-2025-64328
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability in FreePBX Endpoint Manager allows authenticated users to inject commands, potentially granting attackers remote system access. This impacts system integrity and confidentiality. The realistic business risk involves unauthorized data access and system control.
CVE-2025-11546
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A critical vulnerability exists in CLUSTERPRO and EXPRESSCLUSTER software, allowing unauthenticated attackers to execute arbitrary OS commands via crafted network packets. Confirmation of product usage is essential to assess potential exposure and impact on cluster integrity and availability.