NVD disclosure day
CVE-2025-62215
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A race condition in the Windows Kernel allows a local attacker to elevate privileges. This impacts organizations by potentially allowing unauthorized access and control over affected Windows systems, posing a business risk.
CVE-2025-60710
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An authorized local attacker can exploit a flaw in the Host Process for Windows Tasks to gain elevated privileges. This could allow unauthorized access to or modification of sensitive data and system functions, posing a business risk to affected organizations.
CVE-2025-13026
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability exists in Firefox's WebGPU component, potentially allowing attackers to escape the browser's sandbox. This could lead to system compromise if a user visits a malicious website. Uncertainty exists regarding specific exploitation vectors and immediate business impact.
CVE-2025-13024
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability in Firefox's JavaScript engine could allow attackers to execute arbitrary code via malicious websites, potentially leading to system compromise. This issue is addressed in newer versions of Firefox and Thunderbird. Organizations should verify if affected products are in use and consider updatin
CVE-2025-13023
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical sandbox escape vulnerability exists in the Graphics: WebGPU component of Firefox. If reached, this flaw could allow an attacker to bypass security boundaries, potentially impacting system confidentiality, integrity, and availability. The reader should care because this could expose user and system data.
CVE-2025-13022
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability exists in Mozilla's Firefox WebGPU component that could allow remote attackers to execute arbitrary code or cause denial-of-service conditions. This issue arises from incorrect boundary conditions within the component. Users should be aware of this potential risk when browsing the internet.
CVE-2025-13021
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability exists in the Graphics: WebGPU component of Mozilla Firefox due to incorrect boundary conditions. If reachable, this could allow an attacker to achieve high impact, potentially leading to compromise of confidentiality, integrity, and availability. This issue warrants attention to understand its
CVE-2025-8324
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
ManageEngine Analytics Plus contains an unauthenticated SQL injection vulnerability due to improper filter configuration. This could allow remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized access, modification, or deletion of sensitive data. It is important to confirm if this produ
CVE-2025-12539
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A WordPress plugin vulnerability allows unauthenticated attackers to access sensitive cPanel API credentials stored in web-accessible files, potentially leading to hosting environment compromise. This issue warrants attention due to the possibility of arbitrary file uploads and remote code execution.
CVE-2025-12813
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in a WordPress plugin allows unauthenticated attackers to execute arbitrary code on servers by sending specially crafted data via the 'contents' parameter. This could compromise website integrity and functionality.
CVE-2025-11457
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical privilege escalation vulnerability exists in the EasyCommerce WordPress plugin. Unauthenticated attackers can gain administrator access by exploiting a flaw in the order management API, potentially leading to full site compromise. Confirming plugin relevance and network exposure is crucial.
CVE-2025-11170
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in the WP移行専用プラグイン for CPI WordPress plugin, allowing unauthenticated attackers to upload arbitrary files. This could lead to remote code execution on affected servers. The issue is relevant to public-facing WordPress sites that utilize this plugin.
CVE-2025-42890
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in SQL Anywhere Monitor involves hardcoded credentials, which could expose system resources and functionality to unauthorized users and potentially allow attackers to execute arbitrary code. This could have a significant impact on the confidentiality, integrity, and availability of the affected system,
CVE-2025-42887
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
SAP Solution Manager's missing input sanitation allows authenticated attackers to inject and execute malicious code by calling a remote-enabled function module. This vulnerability could lead to full system control, impacting confidentiality, integrity, and availability. The primary concern is determining the relevance