NVD disclosure day
CVE-2025-68860
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An authentication bypass vulnerability exists in Mobile Builder, allowing unauthorized access. This critical flaw enables an attacker to bypass authentication controls, potentially leading to unauthorized access and manipulation of the service. It is important to determine if this technology is in use and assess any po
CVE-2025-68562
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unrestricted file upload vulnerability in MapSVG technology permits an attacker to upload a web shell, potentially enabling unauthorized code execution on a web server. This could allow modification of website content or behavior. Confirmation of relevance and exposure is advised.
CVE-2025-68706
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A stack-based buffer overflow vulnerability exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. This flaw allows an unauthenticated attacker to potentially crash the web server or execute arbitrary code by sending a specially crafted request, impacting device availability and secu
CVE-2025-68897
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical code injection vulnerability exists in the IF AS Shortcode plugin, potentially allowing unauthorized code execution and server compromise. This issue could impact website integrity and hosted data. Confirmation of plugin usage within your environment is advised.
CVE-2025-56333
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated remote attacker can escalate privileges in the Pangolin application's two-factor authentication component. This could lead to unauthorized access, affecting system and data integrity and availability. You should care because this vulnerability could allow an attacker to gain elevated access to protec
CVE-2025-68929
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the Frappe web application framework can allow an authenticated user with specific permissions to execute arbitrary code on the server by accessing a malicious link. This could impact the confidentiality, integrity, and availability of the application.
CVE-2025-65570
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A type confusion flaw in the jsish interpreter can lead to control flow disruption or code execution when processing specific array operations within loops. An attacker could trigger this by providing malicious JavaScript code, potentially causing crashes or allowing unintended program behavior.
CVE-2025-57460
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical file upload vulnerability exists in MachPanel, a web-based control panel. If reachable, this flaw could allow an unauthenticated attacker to upload malicious files and gain unauthorized control of the system. This could impact services and data hosted on the affected platform.
CVE-2025-15228
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical Arbitrary File Upload vulnerability exists in WELLTEND TECHNOLOGY's BPMFlowWebkit, enabling unauthenticated remote attackers to upload and execute web shell backdoors. This could lead to arbitrary code execution on the server. It is important to determine if this technology is used in the environment to asse
CVE-2025-15226
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An Arbitrary File Upload vulnerability in Sunnet's WMPro allows unauthenticated remote attackers to upload and execute malicious code, potentially resulting in arbitrary code execution on the server. This could be a concern if WMPro is exposed to the network.
CVE-2025-52691
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated attacker can upload arbitrary files to a mail server, potentially enabling remote code execution. This impacts mail server systems and business data, posing a risk of operational disruption and unauthorized access.