NVD disclosure day
CVE-2025-65856
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical authentication bypass vulnerability exists in Xiongmai IP cameras, allowing unauthenticated remote attackers to access sensitive device information and live video streams by exploiting the ONVIF implementation. This could expose surveillance video and camera data.
CVE-2025-67418
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A hardcoded default credential vulnerability in ClipBucket allows unauthenticated remote attackers to gain full administrative control of the application. This means attackers can potentially access, modify, or delete all application data and alter its behavior without needing any prior authentication or user interacti
CVE-2024-27708
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical iframe injection vulnerability exists in MyNET, potentially allowing remote attackers to execute arbitrary code by exploiting the `src` parameter. This could lead to the injection of malicious content into affected web pages. Understanding if this technology is in use and accessible is key to assessing the r
CVE-2025-67288
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An arbitrary file upload vulnerability in Umbraco CMS may allow attackers to execute arbitrary code by uploading a crafted PDF. The vendor disputes responsibility, stating file validation is an administrator's duty. This could impact the integrity and availability of the system if not properly secured through configura
CVE-2025-68645
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A Local File Inclusion vulnerability exists in Zimbra Collaboration's Webmail Classic UI. This allows unauthenticated remote attackers to include arbitrary files from the WebRoot directory. This impacts affected organizations by posing a risk of unauthorized data access and potential service disruption. Attackers can e
CVE-2025-67289
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An arbitrary file upload vulnerability in Frappe Framework's Attachments module enables attackers to execute arbitrary code by uploading a malicious XML file. This vulnerability could impact system data and service behavior if the affected technology is reachable.
CVE-2025-12049
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in Sharp Display Solutions Media Player MP-01 allows unauthenticated attackers to access the device's web interface, enabling changes to settings and unauthorized content delivery. This could lead to a loss of control over the device and its displayed content. The primary concern is determining
CVE-2025-15016
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A hard-coded cryptographic key in Ragic's Enterprise Cloud Database allows unauthenticated remote attackers to generate verification information and log in as any user. This could expose system authentication data, and it's uncertain if the organization uses this product.