NVD disclosure day
CVE-2025-65015
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability exists in the joserfc Python library, potentially allowing attackers to send overly large tokens that can overwhelm logging or diagnostic systems. This could impact application availability by causing denial of service through excessive log message generation.
CVE-2025-58034
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An OS command injection vulnerability in Fortinet FortiWeb allows an authenticated attacker to execute unauthorized code. This poses a business risk by potentially compromising the underlying system, impacting data integrity and availability.
CVE-2025-12383
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A race condition in Eclipse Jersey can bypass critical SSL configurations, potentially allowing trust in insecure servers. This issue affects how secure connections are handled and may require specific conditions to exploit, with uncertain business impact.
CVE-2025-41734
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated remote attacker can execute arbitrary PHP files on affected METZ CONNECT devices, gaining full control. This vulnerability is reachable over the network, potentially impacting industrial and building automation systems. The primary concern is identifying deployed devices and their network exposure wi
CVE-2025-41733
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unauthenticated remote attacker can exploit a vulnerability in the commissioning wizard of affected devices to set root credentials, potentially leading to unauthorized control. This issue arises because the wizard does not validate if the device has already been initialized. Readers should care because this could a
CVE-2025-41346
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A security flaw in WinPlus software enables unauthorized users to impersonate others using only their numerical ID, potentially compromising account confidentiality, integrity, and availability. This vulnerability arises from faulty authorization controls, allowing attackers to access user accounts and associated data.
CVE-2025-40549
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Serv-U that, when exploited by an administrator, allows code execution on a directory by bypassing path restrictions. This could lead to further system compromise, especially on Windows.
CVE-2025-40548
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A missing validation flaw in SolarWinds Serv-U could allow an attacker with administrative privileges to execute arbitrary code. This vulnerability requires elevated access to exploit and is considered a medium risk on Windows due to default service account privileges. The product's common deployment as an internet-fac
CVE-2025-40547
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A logic error in Serv-U can be exploited by an attacker with administrative privileges to execute code. This vulnerability requires the attacker to already have administrative access. Exploitation is considered unlikely because administrative privileges are needed.