News | CSURFACE Threat Sensor

CVE-2025-61882 ssvc:act poc-released has-exploit zero-day confirmed-exploited has-poc cisa-kev kev has-threat-actor ransomware severity:CRITICAL active-exploitation breach

CSURFACE · 2025-11-26 ·Highlight

Critical Oracle Identity Manager Flaw Exploited in the Wild

A critical flaw in Oracle Identity Manager, CVE-2025-61757, is actively exploited, allowing remote code execution.

CVE-2025-61757 rce cisa-kev kev severity:CRITICAL ssvc:act poc-released active-exploitation zero-day auth-bypass confirmed-exploited has-poc

CSURFACE · 2025-11-26 ·Highlight

Critical Oracle Identity Manager Flaw Actively Exploited in the Wild

A critical vulnerability in Oracle Identity Manager is being actively exploited, allowing unauthenticated access and remote code execution.

CVE-2025-61757 cisa-kev breach kev ssvc:act poc-released active-exploitation rce has-poc severity:CRITICAL auth-bypass confirmed-exploited

CSURFACE · 2025-11-21 ·Highlight

Clop Ransomware Exploits Oracle E-Business Suite 0-Day Vulnerability

Clop ransomware group exploited a zero-day in Oracle E-Business Suite, breaching systems and accessing sensitive data.

zero-day ransomware-used has-threat-actor

CSURFACE · 2025-11-20 ·Highlight

Fortinet FortiWeb Zero-Day CVE-2025-58034 Actively Exploited in the Wild

A zero-day vulnerability in Fortinet FortiWeb, CVE-2025-58034, is actively exploited, prompting urgent patching.

CVE-2025-58034 kev cisa-kev confirmed-exploited has-exploit ssvc:attend severity:HIGH active-exploitation zero-day

CSURFACE · 2025-11-19 ·Highlight

Shinysp1d3r Ransomware-as-a-Service Threatens VMware ESXi Systems

Shinysp1d3r ransomware-as-a-service, linked to ShinyHunters, targets VMware ESXi systems, posing a significant threat to virtualized environments.

breach has-threat-actor

CSURFACE · 2025-11-19 ·Highlight

Google Chrome Patches Actively Exploited Zero-Day Vulnerability CVE-2025-13223

Google patched a critical zero-day in Chrome's V8 engine, CVE-2025-13223, actively exploited in the wild.

CVE-2025-13223 rce cisa-kev ssvc:attend severity:HIGH zero-day patched kev confirmed-exploited active-exploitation

CSURFACE · 2025-11-11 ·Highlight

Critical Triofox Vulnerability CVE-2025-12480 Actively Exploited in the Wild

A critical vulnerability in Triofox, CVE-2025-12480, is being actively exploited, urging immediate patching.

CVE-2025-12480 disclosed active-exploitation cisa-kev kev confirmed-exploited ssvc:act severity:CRITICAL

CSURFACE · 2025-11-11 ·Highlight

Critical Triofox Vulnerability CVE-2025-12480 Actively Exploited in the Wild

A critical vulnerability in Gladinet's Triofox, CVE-2025-12480, is being actively exploited, prompting urgent patching.

CVE-2025-12480 confirmed-exploited ssvc:act severity:CRITICAL active-exploitation cisa-kev kev

CSURFACE · 2025-11-11 ·Highlight

Samsung Galaxy Devices Targeted by LANDFALL Spyware via Critical Zero-Day

Samsung Galaxy devices are under threat from the LANDFALL spyware, exploiting a critical zero-day vulnerability.

CVE-2025-21042 active-exploitation zero-day rce cisa-kev kev confirmed-exploited poc-released has-poc severity:CRITICAL ssvc:act

CSURFACE · 2025-11-05 ·Highlight

Critical RCE Flaw in CentOS Web Panel Actively Exploited

A critical RCE vulnerability in CentOS Web Panel is being actively exploited, urging immediate patching.

CVE-2025-48703 poc-released active-exploitation rce cisa-kev kev confirmed-exploited has-poc severity:CRITICAL ssvc:attend

CSURFACE · 2025-11-02 ·Highlight

Critical CVE-2025-61932 Exploited in Motex Lanscope Endpoint Manager Attacks

CVE-2025-61932, a critical flaw in Motex Lanscope Endpoint Manager, is actively exploited by the Tick Group.

CVE-2025-61932 zero-day cisa-kev kev confirmed-exploited ssvc:act severity:CRITICAL active-exploitation

CSURFACE · 2025-10-28 ·Highlight

Google Chrome Zero-Day CVE-2025-2783 Exploited in Global Cyberattacks

A critical Chrome zero-day, CVE-2025-2783, is being exploited globally, affecting Windows users.

CVE-2025-2783 disclosed poc-released active-exploitation ssvc:attend severity:HIGH zero-day cisa-kev apt-used kev confirmed-exploited has-poc

CSURFACE · 2025-10-25 ·Highlight

Storm-0501 Exploits Critical Adobe Commerce Flaw CVE-2025-54236

Storm-0501 is exploiting a critical Adobe Commerce flaw, CVE-2025-54236, leading to widespread e-commerce breaches.

CVE-2025-54236 active-exploitation cisa-kev kev confirmed-exploited ssvc:act poc-released breach has-exploit has-poc ransomware severity:CRITICAL

CSURFACE · 2025-10-20 ·Highlight

8Base Ransomware Group Strikes Volkswagen, Leaks Sensitive Data

The 8Base ransomware group has attacked Volkswagen, stealing and leaking sensitive data, highlighting the ongoing threat of ransomware.

has-threat-actor ransomware-used breach

CSURFACE · 2025-10-19 ·Highlight

Critical Vulnerability in WatchGuard Fireware OS Exploited in the Wild

A critical vulnerability in WatchGuard Fireware OS, CVE-2025-9242, is being actively exploited, allowing remote code execution.

CVE-2025-9242 poc-released has-poc ssvc:act severity:CRITICAL confirmed-exploited active-exploitation rce cisa-kev vpn kev

CSURFACE · 2025-10-17 ·Highlight

Cisco IOS Zero-Day Exploited for Rootkits and Denial of Service

A Cisco IOS zero-day, CVE-2025-20352, is exploited to plant rootkits and cause DoS, urging immediate patching.

CVE-2025-20352 has-poc poc-released active-exploitation networking kev confirmed-exploited ssvc:attend severity:HIGH zero-day cisa-kev

CSURFACE · 2025-10-15 ·Highlight

Oracle E-Business Suite Vulnerability CVE-2025-61884 Actively Exploited by Ransomware Groups

CVE-2025-61884 in Oracle E-Business Suite is being exploited by ransomware groups, prompting urgent patching.

CVE-2025-61884 active-exploitation zero-day has-threat-actor severity:HIGH ssvc:act cisa-kev kev confirmed-exploited ransomware

CSURFACE · 2025-10-11 ·Highlight

Unpatched Vulnerability in Gladinet CentreStack and Triofox Actively Exploited

A high-severity vulnerability in Gladinet CentreStack and Triofox is being actively exploited, with no patch available.

CVE-2025-11371 severity:HIGH lfi cisa-kev kev confirmed-exploited has-exploit active-exploitation zero-day ssvc:act

CSURFACE · 2025-10-09 ·Highlight

Critical Flaw in WordPress Plugin Allows Admin Account Access

A critical vulnerability in the Service Finder Bookings WordPress plugin allows attackers to access admin accounts.

CVE-2025-5947 active-exploitation cms ssvc:attend severity:CRITICAL

CSURFACE · 2025-10-07

Critical 'RediShell' Vulnerability in Redis Allows Remote Code Execution

A critical vulnerability in Redis, CVE-2025-49844, allows remote code execution and has been patched.

CVE-2025-49844 poc-released rce memory-corruption has-poc ssvc:track* severity:CRITICAL

CSURFACE · 2025-10-07 ·Highlight

Storm-1175 Exploits GoAnywhere Zero-Day to Deploy Medusa Ransomware

Storm-1175 exploits a GoAnywhere zero-day to deploy Medusa ransomware, demanding ransoms up to $15 million.

zero-day rce has-threat-actor active-exploitation

CSURFACE · 2025-10-07 ·Highlight

Zimbra XSS Flaw Exploited to Breach Brazilian Military Systems

A Zimbra XSS vulnerability was exploited to breach Brazilian military systems, prompting urgent patching.

CVE-2025-27915 kev confirmed-exploited active-exploitation zero-day severity:MEDIUM xss cisa-kev ssvc:attend

CSURFACE · 2025-10-03 ·Highlight

CVE-2025-4008: Command Injection Flaw in Meteobridge Actively Exploited

A command injection vulnerability in Meteobridge, CVE-2025-4008, is actively exploited, prompting CISA action.

CVE-2025-4008 kev confirmed-exploited ssvc:attend severity:HIGH active-exploitation cisa-kev

CSURFACE · 2025-09-24 ·Highlight

Libraesva ESG Vulnerability Exploited in the Wild Within Days of Disclosure

A command injection flaw in Libraesva ESG is actively exploited, prompting urgent patching.

CVE-2025-59689 severity:MEDIUM active-exploitation zero-day cisa-kev kev confirmed-exploited ssvc:attend

CSURFACE · 2025-09-18 ·Highlight

Google Patches Actively Exploited Chrome Zero-Day CVE-2025-10585

Google patched a critical Chrome zero-day, CVE-2025-10585, actively exploited before disclosure.

CVE-2025-10585 confirmed-exploited has-poc severity:CRITICAL zero-day kev cisa-kev ssvc:act poc-released active-exploitation

CSURFACE · 2025-09-18 ·Highlight

Google Patches Actively Exploited Chrome Zero-Day CVE-2025-10585

Google has patched a critical zero-day vulnerability in Chrome, CVE-2025-10585, actively exploited in the wild.

CVE-2025-10585 kev severity:CRITICAL poc-released zero-day cisa-kev active-exploitation confirmed-exploited has-poc ssvc:act

CSURFACE · 2025-09-17 ·Highlight

Apple Patches Critical Zero-Day Exploited in Sophisticated Attacks

Apple has patched a critical zero-day vulnerability in iOS, iPadOS, and macOS, actively exploited in sophisticated attacks.

CVE-2025-43300 has-poc disclosed active-exploitation cisa-kev kev confirmed-exploited ssvc:act severity:CRITICAL poc-released zero-day

CSURFACE · 2025-09-14 ·Highlight

Samsung Patches Critical Zero-Day CVE-2025-21043 Exploited in the Wild

Samsung patched a critical zero-day vulnerability, CVE-2025-21043, affecting mobile devices, which was actively exploited in the wild.

CVE-2025-21043 kev confirmed-exploited ssvc:act severity:CRITICAL active-exploitation zero-day cisa-kev

CSURFACE · 2025-09-14 ·Highlight

Critical Deserialization Flaw in DELMIA Apriso Actively Exploited

A critical deserialization vulnerability in DELMIA Apriso is actively exploited, prompting urgent mitigation.

CVE-2025-5086 rce cisa-kev severity:CRITICAL active-exploitation deserialization kev confirmed-exploited ssvc:attend