NVD disclosure day
CVE-2025-43520
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A memory corruption vulnerability in Apple operating systems could allow a malicious application to cause system instability or alter kernel memory, impacting affected organizations and their data.
CVE-2025-43510
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A memory corruption vulnerability in Apple operating systems could allow a malicious application to alter shared memory, potentially causing data integrity issues and system instability for affected organizations. This issue has been addressed in software updates.
CVE-2025-14611
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Gladinet CentreStack and Triofox have a security weakness in their encryption, potentially allowing unauthorized local file access and system compromise. This affects public-facing endpoints and requires immediate attention from affected organizations.
CVE-2025-14174
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A memory access vulnerability in Google Chrome's ANGLE component allows attackers to access memory via a crafted HTML page. This could impact organizations by affecting employees, systems, and data, posing a business risk. Organizations should prioritize addressing this.
CVE-2025-66430
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An incorrect access control vulnerability exists in Plesk, a web hosting control panel. This flaw could allow an unauthenticated attacker to gain unauthorized root-level access to a Plesk server. Since Plesk is designed to be internet-facing for managing web hosting services, this issue poses a significant risk to serv
CVE-2025-65854
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Insecure permissions in MineAdmin's scheduled tasks feature allow unauthenticated attackers to execute arbitrary commands, potentially leading to a full account takeover. This critical vulnerability could compromise system integrity and grant unauthorized access to sensitive information.
CVE-2025-54947
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Apache StreamPark versions prior to 2.1.7 contain a vulnerability where a hard-coded encryption key can be discovered. This may allow attackers to decrypt sensitive data or gain unauthorized system access, which is relevant if the platform handles confidential information.
CVE-2025-58130
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An "Insufficiently Protected Credentials" vulnerability exists in Apache Fineract. If reachable over a network, this could allow unauthorized access to sensitive credentials, potentially leading to data compromise. This issue affects financial and core banking systems, so confirming relevance and assessing exposure is
CVE-2025-67728
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in Fireshare, a media sharing application, allows for remote code execution through malicious filenames during video uploads. Attackers can exploit this to execute system commands or upload files to arbitrary directories. The issue is relevant if Fireshare is deployed and reachable.
CVE-2025-14344
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in the Multi Uploader for Gravity Forms WordPress plugin allows unauthenticated attackers to delete arbitrary server files by exploiting insufficient path validation. This could lead to data loss or service disruption. Organizations should confirm if they use this plugin to assess potential exposure.
CVE-2025-12963
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A WordPress plugin vulnerability allows unauthenticated attackers to escalate privileges by changing user email addresses via a REST API endpoint, potentially leading to account takeover. This could grant attackers unauthorized access to WordPress sites and administrative control.