NVD disclosure day

Published threat advisories for December 3, 2025

CVE advisoryCRITICAL

CVE-2025-64055

Fanvil X210 Firmware Authentication Bypass Vulnerability

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

An authentication bypass in Fanvil devices allows unauthenticated local network attackers to access administrative functions like file uploads and firmware updates. This critical vulnerability could lead to unauthorized control and compromise of the device.

NVD modified: NVD date unavailable
CVE advisoryKnown Exploit

CVE-2025-55182

React Server Components Remote Code Execution Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical vulnerability in React Server Components and Next.js allows unauthenticated remote code execution by unsafely deserializing HTTP request payloads. This impacts organizations using affected versions, creating a risk of unauthorized system control and data compromise.

NVD modified: NVD date unavailable • CISA KEV