NVD disclosure day
CVE-2025-65095
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical cross-site scripting vulnerability exists in Lookyloo, a web interface for capturing and displaying website domain relationships. If reachable, attackers could inject malicious scripts into the application's pages, potentially impacting data integrity and user sessions. Confirming the presence and reachabili
CVE-2025-65026
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in the esm.sh CDN service's CSS-to-JavaScript conversion allows attackers to inject malicious code into modules. This flaw, present in versions prior to 136, can lead to cross-site scripting in browsers or remote code execution in Electron applications when CSS files are processed without proper sanitiz
CVE-2025-65025
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A path traversal vulnerability in esm.sh allows attackers to write files to arbitrary server locations by uploading a specially crafted NPM package, potentially compromising the service. This issue is relevant because esm.sh is a public-facing CDN. The vulnerability has been patched in version 136.
CVE-2025-65021
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An Insecure Direct Object Reference vulnerability in Rallly's poll finalization feature allows any authenticated user to finalize polls they do not own. This could lead to unauthorized conversion of polls into events, potentially impacting data integrity and availability.
CVE-2025-13315
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical access control vulnerability exists in Twonky Server, allowing unauthenticated attackers to bypass authentication and access log files containing administrator credentials. This issue could lead to unauthorized access to affected systems. Readers should care if Twonky Server is deployed within their environm
CVE-2025-34329
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
AudioCodes Fax Server and Auto-Attendant IVR appliances contain a critical vulnerability allowing unauthenticated remote attackers to execute arbitrary commands. This is possible through an insecure backup upload feature that does not validate file types, enabling the upload of malicious configuration files that are th
CVE-2025-34328
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in AudioCodes Fax Server and Auto-Attendant IVR appliances, allowing unauthenticated attackers to write arbitrary files to the web-accessible directory. This can lead to the execution of malicious code on the appliance with high privileges. Confirmation of affected systems within your en
CVE-2025-10437
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical SQL injection vulnerability in the Webpack Management System could allow unauthorized manipulation of database commands. If reachable, this could lead to unauthorized access or modification of sensitive data, impacting system integrity.
CVE-2025-12057
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in the WavePlayer WordPress plugin, allowing unauthenticated attackers to upload arbitrary files to a server, potentially leading to remote code execution. This is due to insufficient authorization and file validation in its AJAX actions. Ensure your WordPress sites are not exposed to th