NVD disclosure day

Published threat advisories for November 29, 2025

CVE-2025-66216

AIS-catcher Heap Buffer Overflow Vulnerability

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

A heap buffer overflow in AIS-catcher's AIS::Message class allows an attacker to overwrite approximately 1KB of data in a 128-byte buffer, potentially impacting system integrity. This vulnerability exists in versions prior to 0.64 and has been patched. The primary concern is confirming if this software is in use and re

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2025-65112

PubNet Unauthenticated Package Upload and Identity Spoofing

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical vulnerability in PubNet allows unauthenticated users to upload packages as any user, enabling identity spoofing and potential supply chain attacks. This issue affects self-hosted PubNet instances prior to version 1.1.3, and successful exploitation could compromise software integrity.

NVD modified: NVD date unavailable