NVD disclosure day
CVE-2025-68114
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in the Capstone disassembly framework allows for memory corruption through specially crafted input, potentially leading to stack buffer underflow or overflow. This could impact systems that use Capstone for code analysis, affecting data integrity and system stability. The primary concern is identifying
CVE-2025-67791
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An incomplete agent authentication configuration in DriveLock tenants allows attackers to impersonate any DriveLock agent on the network against the DriveLock Enterprise Service. This could enable unauthorized access and control over systems and sensitive data managed by DriveLock.
CVE-2025-67793
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A privilege escalation vulnerability in DriveLock allows users with specific permissions to gain higher access through an API call, primarily impacting cloud multi-tenant deployments. This could lead to unauthorized administrative control.
CVE-2025-67493
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Homarr, an open-source dashboard, has a vulnerability where un-sanitized inputs in LDAP search queries can allow privilege escalation for authenticated users. This could lead to unauthorized access to other users' groups. Uncertainty exists regarding the reachability of instances and the specific impact on affected dat
CVE-2025-43529
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability affects Apple's WebKit, impacting Safari, iOS, iPadOS, macOS, tvOS, watchOS, and visionOS. Malicious web content can lead to arbitrary code execution, potentially exposing data and disrupting operations. This vulnerability has reportedly been exploited in sophisticated, targeted attacks.
CVE-2025-67787
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A Cross-Site Scripting vulnerability in DriveLock Operations Center can allow an attacker to take over user sessions over a network. This could impact the confidentiality and integrity of data.
CVE-2025-67781
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in DriveLock allows local unprivileged users to escalate privileges on Windows computers. This means an attacker with existing local access could gain greater control over an affected system. Users should confirm if their DriveLock installations are impacted and prioritize remediation.
CVE-2025-67073
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical buffer overflow vulnerability exists in Tenda AC10 firmware's web server, potentially allowing remote attackers to cause denial of service or execute code via crafted network requests without authentication.
CVE-2025-67165
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An Insecure Direct Object Reference in Pagekit CMS may allow an unauthenticated attacker to escalate privileges. This could lead to unauthorized access and modification of website content and sensitive data if the CMS is network-accessible. Confirming Pagekit usage and assessing exposure is crucial.
CVE-2025-67164
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An arbitrary file upload vulnerability in Pagekit CMS allows authenticated users to upload malicious PHP files, potentially leading to arbitrary code execution. This could impact the integrity and availability of the system.
CVE-2025-20393
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in Cisco's Spam Quarantine feature allows remote attackers to execute arbitrary commands with root privileges on affected email security devices, posing a significant business risk. The flaw stems from insufficient validation of HTTP requests.
CVE-2025-59374
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Supply chain compromise affected ASUS Live Update client versions with unauthorized modifications. Devices meeting specific conditions and using compromised versions could perform unintended actions. The client is end-of-support, so no current products are impacted, limiting business risk.