NVD disclosure day
CVE-2025-13658
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, leading to SYSTEM-level privileges. This affects monitoring systems and bypasses code signing controls. The concern is to confirm device presence and assess potential exposure.
CVE-2025-13542
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in the DesignThemes LMS plugin allows unauthenticated attackers to gain administrator privileges by registering with an administrator role. This could lead to unauthorized control and compromise of the affected WordPress site.
CVE-2025-13510
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
The Iskra iHUB and iHUB Lite smart metering gateways have a critical vulnerability where their web management interface is accessible without authentication. This allows unauthenticated users to access and modify critical device settings, potentially disrupting metering services.
CVE-2025-13828
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A non-privileged user can install arbitrary packages, potentially executing malicious code and escalating privileges on systems that use composer for package management, even if composer-based updates are disabled. This could allow a low-privileged user to obtain higher privileges on the platform.
CVE-2025-59703
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Entrust nShield hardware security modules are vulnerable to a physical tamper attack that allows an attacker with direct access to bypass tamper evidence and access internal components. This could potentially compromise cryptographic operations and sensitive data if the device is reachable by a physically proximate att
CVE-2025-59695
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Entrust nShield hardware security modules allows an OS root user to alter firmware without authentication, potentially compromising the device's security functions.
CVE-2025-59693
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Entrust nShield devices allows a physically proximate attacker to bypass tamper labels, open the chassis, and access the JTAG connector to gain debug access and escalate privileges. This could compromise sensitive hardware functions and lead to unauthorized system control.
CVE-2025-41744
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Sprecher Automation SPRECON-E devices use default cryptographic keys, allowing unprivileged remote attackers to access all encrypted communications, compromising data confidentiality and integrity. This vulnerability is relevant to organizations using these devices in critical infrastructure, as it could expose sensiti
CVE-2025-41742
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Sprecher Automation SPRECON devices contain a critical vulnerability due to default cryptographic keys, allowing unauthorized remote attackers to read, modify, or write project data and access devices via remote maintenance. This could lead to the compromise of sensitive operational data and device control. The main co