NVD disclosure day
CVE-2025-34291
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical flaw in Langflow lets attackers steal user sessions and run malicious code, potentially compromising your systems and data by exploiting a web configuration weakness.
CVE-2025-66644
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Array Networks ArrayOS AG, used in secure access gateways, has a command injection vulnerability. This flaw allows attackers to execute arbitrary commands, potentially leading to unauthorized access and data compromise. Organizations using affected versions face significant business risk due to the potential for system
CVE-2025-64054
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A reflected cross-site scripting vulnerability in Fanvil IP phones could allow an attacker to cause a denial of service or execute arbitrary commands via a crafted POST request to the web configuration interface. The relevance of this vulnerability depends on the network reachability of these devices, which are typical