NVD disclosure day
CVE-2025-56157
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Dify versions up to 1.5.1 are affected by a vulnerability where default PostgreSQL credentials are included in the source code. If reachable, this could allow unauthorized access to data and system control. The vendor notes that the database port is not exposed by default in later versions, but the presence of hardcode
CVE-2025-63389
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in the Ollama platform's API allows remote, unauthenticated attackers to manage AI models. This could lead to unauthorized control and disruption of model availability and integrity if the API endpoints are externally accessible. Organizations using Ollama should verify its network exposure and
CVE-2025-63388
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Dify's system features API due to an overly permissive CORS policy. This misconfiguration allows any external website to make cross-origin requests, potentially leading to unauthorized access to sensitive system information or the execution of unintended actions, although the supplier
CVE-2025-63386
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A Cross-Origin Resource Sharing misconfiguration in Dify's setup API allows any external domain to make authenticated requests, potentially leading to unauthorized access and data compromise. The supplier states this configuration is intentional for bootstrapping, but the implications for data security warrant review.
CVE-2025-7358
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A critical hard-coded credentials vulnerability in SoliClub allows authentication abuse, potentially enabling unauthorized access to application data and functionalities. This issue could lead to significant compromise if exploited. The vulnerability is reachable over the network.
CVE-2025-14860
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability exists in Firefox's Disability Access APIs, potentially allowing remote code execution if a user visits a malicious site. This critical issue could impact system data.
CVE-2025-10910
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A flaw in Govee's cloud platform allows remote attackers to bind existing devices to their own accounts, enabling full control and removal from the legitimate owner's account. The vulnerability lies in the server-side API's device binding process, which lacks cryptographic verification from the device itself. This coul
CVE-2025-40602
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
SonicWall SMA1000 appliance management consoles are affected by a local privilege escalation vulnerability. This could allow an attacker to gain elevated access, potentially leading to unauthorized data modification or system changes, posing a business risk.
CVE-2025-64374
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The StylemixThemes Motors theme has a vulnerability that could allow unauthorized users to upload malicious files, posing a risk to system integrity and availability. This could lead to the execution of arbitrary code if exploited. Confirming its use and assessing exposure is crucial.
CVE-2025-64233
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A deserialization flaw in the Codiqa theme enables the injection of untrusted data, potentially leading to object injection. This vulnerability is externally reachable, meaning it can be exploited over a network without authentication. The issue is rated critical, indicating a high severity, and could impact the confid
CVE-2025-64231
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in a WordPress plugin allows for unrestricted upload of dangerous file types, potentially enabling attackers to upload malicious files to a site. If reachable, this could lead to the compromise of the entire website. This issue is rated as critical.
CVE-2025-64227
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A deserialization vulnerability in Sprout Invoices allows object injection via untrusted data. If reachable, this could enable attackers to compromise systems processing invoices. Confirming the use and exposure of this invoicing software is important for understanding potential impact.
CVE-2025-64188
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An incorrect privilege assignment vulnerability exists in the PenciDesign Soledad WordPress theme that could allow privilege escalation. If reachable, an unauthenticated attacker could potentially exploit this to gain elevated privileges on a website, impacting data integrity and confidentiality. Confirming the relevan
CVE-2025-68461
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in Roundcube Webmail may allow for script execution, potentially impacting user sessions and data. Organizations should identify and patch affected systems promptly to mitigate business risk.