NVD disclosure day
CVE-2025-65849
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A cryptanalytic break in Altcha's Proof-of-Work obfuscation mode enables remote visitors to recover hidden data via mathematical deduction. While intended to deter bots, the mechanism's public-facing nature means it could be exposed to unauthenticated users, potentially leading to unauthorized data access.
CVE-2025-65548
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in Nutshell, a component of the Cashu token system, where insufficient validation of preimage sizes when tokens are spent allows an attacker to fill the mint's database and disk with arbitrary data. This could lead to a denial-of-service, impacting service availability. Understanding if your orga
CVE-2025-64081
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical SQL injection vulnerability exists in a patient queue management system that could allow unauthenticated attackers to execute arbitrary SQL commands. This could potentially lead to unauthorized access to or modification of sensitive patient scheduling data. Confirming system usage and exposure is necessary t
CVE-2025-48633
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A logic error in Android's Device Policy Manager Service allows for privilege escalation by adding a Device Owner after provisioning. This impacts affected organizations by enabling local attackers to gain elevated device control without user interaction, posing a business risk to data and operations.
CVE-2025-48626
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in Android's application launching process allows remote privilege escalation without user interaction due to a precondition check failure, potentially impacting system integrity and confidentiality.
CVE-2025-48572
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A permissions bypass in the Android operating system framework allows for local privilege escalation without user interaction. This impacts organizations using affected Android devices by enabling attackers to gain elevated control and access. The realistic business risk involves unauthorized system access and potentia
CVE-2025-61318
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Emlog Pro has a critical vulnerability allowing arbitrary file deletion due to improper path verification in its administrative components. This could lead to system disruption or data loss. It's important to identify and assess any deployed instances of this technology.
CVE-2025-27020
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An improper SSH service configuration in Infinera MTC-9 allows unauthenticated attackers to execute commands and access file system data. This vulnerability, which does not require user interaction, could lead to system compromise. It is important to confirm if your organization uses affected Infinera MTC-9 devices.
CVE-2025-27019
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A critical vulnerability exists in the remote shell service of Infinera MTC-9 network devices, allowing an unauthenticated attacker to gain system access by activating a reverse shell using password-less accounts. This could compromise system integrity and availability if the affected devices are reachable.
CVE-2023-53751
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in the Linux kernel's CIFS component could allow for use-after-free bugs when handling server hostnames during reconnection. This could lead to system instability or unexpected behavior if reachable.
CVE-2025-40320
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability exists in the Linux kernel's SMB client when handling retried file information queries. This could lead to system instability or unpredictable behavior.