NVD disclosure day
CVE-2025-64655
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An improper authorization flaw in Microsoft Dynamics OmniChannel SDK Storage Containers enables unauthorized network access for privilege escalation. This could lead to significant compromise of system integrity and data confidentiality if the technology is in use and reachable.
CVE-2025-62207
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A critical elevation of privilege vulnerability exists in Microsoft Azure Monitor. If reachable, this issue could allow an unauthenticated attacker to gain higher access, potentially impacting system data and service behavior. Understanding your Azure Monitor deployments is key to overseeing your cloud security.
CVE-2025-59245
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability exists in Microsoft SharePoint Online, potentially allowing unauthenticated attackers to gain elevated privileges. This issue is accessible over the network, posing a risk to sensitive data and system control. Organizations should confirm their use of SharePoint Online and assess potential expo
CVE-2025-49752
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability in Azure Bastion may allow an unauthenticated attacker to gain elevated privileges. This could potentially lead to unauthorized access to sensitive information or service disruption within your cloud environment. Confirming the presence and reachability of Azure Bastion in your deployments is c
CVE-2025-34320
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
BASIS BBj contains a flaw in a web endpoint that allows unauthenticated directory traversal to read arbitrary system files. This could expose credentials, leading to administrative access and command execution. Confirmation of product deployment and network exposure is necessary to determine relevance.
CVE-2025-40604
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
SonicWall Email Security appliances can be compromised by attackers with VMDK or datastore access, enabling them to modify system files and achieve persistent code execution due to a lack of integrity verification for root filesystem images. This vulnerability impacts the integrity of a core security appliance.
CVE-2025-12414
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in Looker's OIDC authentication allows an attacker to take over accounts by exploiting email address string normalization. This could lead to unauthorized access to sensitive data within Looker instances, impacting both Looker-hosted and self-hosted deployments. While Looker-hosted instances are secured