NVD disclosure day
CVE-2025-56157
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Dify versions up to 1.5.1 are affected by a vulnerability where default PostgreSQL credentials are included in the source code. If reachable, this could allow unauthorized access to data and system control. The vendor notes that the database port is not exposed by default in later versions, but the presence of hardcode
CVE-2025-7358
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A critical hard-coded credentials vulnerability in SoliClub allows authentication abuse, potentially enabling unauthorized access to application data and functionalities. This issue could lead to significant compromise if exploited. The vulnerability is reachable over the network.
CVE-2025-40602
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
SonicWall SMA1000 appliance management consoles are affected by a local privilege escalation vulnerability. This could allow an attacker to gain elevated access, potentially leading to unauthorized data modification or system changes, posing a business risk.
CVE-2025-68461
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in Roundcube Webmail may allow for script execution, potentially impacting user sessions and data. Organizations should identify and patch affected systems promptly to mitigate business risk.