NVD disclosure day
CVE-2025-13597
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
The AI Feeds WordPress plugin has a critical vulnerability allowing unauthenticated attackers to upload arbitrary files. This could lead to overwriting plugin files and potentially enable remote code execution on affected servers.
CVE-2025-13595
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability exists in the CIBELES AI plugin for WordPress, specifically in the 'actualizador_git.php' file. This flaw allows unauthenticated attackers to upload arbitrary files, which could lead to overwriting existing plugin files and potentially enable remote code execution on the server. Its relevance s
CVE-2025-58360
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in GeoServer allows attackers to insert external entities into XML requests, potentially leading to unauthorized data access or service disruption. Organizations using affected versions face business risk from this exploit.
CVE-2025-66016
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in a cryptographic protocol allows a malicious signer to reconstruct a full private key due to a missing check in the ZK proof. This could compromise sensitive cryptographic operations and the integrity of systems using the affected protocol version. The issue is patched in version 0.6.3, with recommend
CVE-2025-61168
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in SIGB PMB's `cms_rest.php` component allows attackers to execute arbitrary code by unserializing files. As this component is network-reachable and requires no authentication, systems using this software could be at risk of unauthorized code execution and system compromise.
CVE-2025-64693
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A heap-based buffer overflow vulnerability in MaLion and MaLionCloud's Security Point could allow remote attackers to execute code with system privileges. This occurs when the component processes a specially crafted request, potentially impacting system confidentiality, integrity, and availability.
CVE-2025-62691
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical stack-based buffer overflow vulnerability exists in MaLion and MaLionCloud's Security Point, allowing unauthenticated remote attackers to execute arbitrary code with SYSTEM privileges by sending crafted HTTP header requests. This could enable attackers to gain control of affected systems.
CVE-2025-59366
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An authentication-bypass vulnerability in AiCloud may allow unauthorized access to specific functions by exploiting an unintended interaction with Samba functionality. This could lead to unauthorized execution of functions within the affected technology.
CVE-2025-13559
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in the EduKart Pro WordPress plugin allows unauthenticated users to register as administrators by exploiting flaws in the user registration function. This could lead to a complete compromise of a website.
CVE-2025-6389
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
The Sneeit Framework WordPress plugin has a critical vulnerability that allows unauthenticated attackers to execute arbitrary code on servers. This could lead to the installation of backdoors or the creation of unauthorized administrative accounts, compromising website integrity and security. This issue is classified a