NVD disclosure day
CVE-2025-64055
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An authentication bypass in Fanvil devices allows unauthenticated local network attackers to access administrative functions like file uploads and firmware updates. This critical vulnerability could lead to unauthorized control and compromise of the device.
CVE-2025-66489
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An authentication flaw in Cal.com's login process allows bypassing password verification with a TOTP code, potentially granting unauthorized account access. This vulnerability affects open-source scheduling software and could lead to account compromise if reachable. Confirming its use and deployed versions is crucial.
CVE-2025-66222
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in DeepChat's diagram renderer allows attackers to execute JavaScript, potentially leading to remote code execution via the Electron IPC bridge. This could permit arbitrary code execution on a user's system. The primary concern is identifying if and where DeepChat is deployed.
CVE-2025-34319
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
TOTOLINK wireless router firmware has an OS command injection vulnerability. Unauthenticated attackers can send crafted requests to execute commands on the device, potentially impacting network security. Identifying and confirming exposure of affected devices is crucial.
CVE-2024-32641
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in Masa CMS allows unauthenticated attackers to execute arbitrary code remotely via the addParam function. This could compromise system integrity and availability. Confirm if your organization uses Masa CMS to assess potential exposure and impact.
CVE-2025-55182
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in React Server Components and Next.js allows unauthenticated remote code execution by unsafely deserializing HTTP request payloads. This impacts organizations using affected versions, creating a risk of unauthorized system control and data compromise.
CVE-2025-13390
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in the WP Directory Kit WordPress plugin, enabling unauthenticated attackers to bypass authentication and gain administrative control. This could result in a complete website takeover. The issue stems from a cryptographically weak token generation method in the auto-login function.
CVE-2025-13342
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in the Frontend Admin WordPress plugin allows unauthenticated attackers to modify critical site options, such as user registration and administrator email, by submitting crafted data to public forms. This could lead to unauthorized control over website configurations. The main concern is confirming rele
CVE-2025-13486
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in the Advanced Custom Fields: Extended WordPress plugin, enabling unauthenticated attackers to execute arbitrary code. This allows for potential server compromise, including backdoor installation or creation of unauthorized administrator accounts. Confirmation of relevance and plugin ex