News | CSURFACE Threat Sensor

CSURFACE Threat Sensor · 2026-07-09 ·Highlight

Critical RCE Vulnerability in Balbooa Forms for Joomla

CVE-2026-56291 allows unauthenticated file uploads; update or disable the extension immediately.

CVE-2026-56291 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-08 ·Highlight

Critical Vulnerability in Blocksy Companion Pro Plugin Allows Remote Code Execution

CVE-2026-58480 affects Blocksy Companion Pro plugin versions before 2.1.47; update immediately.

CVE-2026-58480 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-07 ·Highlight

Critical OS Command Injection Vulnerability in Decolua 9Router

CVE-2026-59800 exposes 9Router to OS command injection; update to version 0.4.44 or later immediately.

CVE-2026-59800 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-07 ·Highlight

CISA Adds CVE-2026-48908 for JoomShaper SP Page Builder to KEV List

CVE-2026-48908 allows unauthenticated users to upload arbitrary files; update SP Page Builder immediately.

CVE-2026-48908 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-07-07 ·Highlight

CISA Adds Joomlack Page Builder Vulnerability to KEV List

CVE-2026-56290 allows unauthenticated file uploads leading to RCE; update Page Builder immediately.

CVE-2026-56290 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-07-07 ·Highlight

CISA Adds Adobe ColdFusion Path Traversal Vulnerability to KEV List

CVE-2026-48282 affects Adobe ColdFusion; defenders should apply patches immediately.

CVE-2026-48282 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-07-07 ·Highlight

CVE-2026-55255: Langflow Authorization Bypass Vulnerability Requires Immediate Attention

CVE-2026-55255 affects Langflow versions prior to 1.9.1; update immediately to mitigate risks.

CVE-2026-55255 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-07-02 ·Highlight

Critical RCE Vulnerability in Divi Form Builder Affects All Versions Up to 5.1.8

CVE-2026-5524 exposes Divi Form Builder to Remote Code Execution; update to version 5.1.9 or later immediately.

CVE-2026-5524 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-02 ·Highlight

Critical RCE Vulnerability in Blocksy Companion Pro Affects Versions <= 2.1.46

CVE-2026-57624 allows unauthenticated remote code execution; update to version 2.1.47 or later immediately.

CVE-2026-57624 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-01 ·Highlight

CISA Adds CVE-2026-45659 for Microsoft SharePoint Server Exploitation Risk

CVE-2026-45659 affects Microsoft SharePoint Server; defenders should apply patches immediately.

CVE-2026-45659 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-06-29 ·Highlight

CISA Adds SimpleHelp Authentication Bypass Vulnerability to KEV List

CVE-2026-48558 affects SimpleHelp versions 5.5.15 and prior; defenders should update immediately.

CVE-2026-48558 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-06-26

High-severity XSS vulnerability in MapPress Maps for WordPress

CVE-2026-56011 affects MapPress Maps for WordPress <= 2.97.3; update to the latest version immediately.

CVE-2026-56011 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-06-25 ·Highlight

CISA Adds CVE-2026-12569 for PTC Windchill and FlexPLM RCE Vulnerability

CVE-2026-12569 affects PTC Windchill and FlexPLM; defenders should update to version 11.0 M030 or later.

CVE-2026-12569 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-06-25 ·Highlight

CISA Adds Cisco Unified Communications Manager SSRF Vulnerability to KEV List

CVE-2026-20230 affects Cisco Unified Communications Manager; organizations should apply patches immediately.

CVE-2026-20230 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-06-24 ·Highlight

Exploit for CVE-2026-42208 in LiteLLM Proxy Server Now Active

CVE-2026-42208 affects LiteLLM versions 1.81.16 to 1.83.6; update to version 1.83.7 immediately.

CVE-2026-42208 auto-generated csurface-intel exploit-public

CSURFACE Threat Sensor · 2026-06-23 ·Highlight

CISA Adds CVE-2026-34910 to KEV List for Ubiquiti UniFi OS

CVE-2026-34910 affects Ubiquiti UniFi OS; defenders should apply patches immediately.

CVE-2026-34910 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-06-23 ·Highlight

CISA Adds CVE-2025-67038 for Lantronix EDS5000 Code Injection Vulnerability

CVE-2025-67038 affects Lantronix EDS5000; defenders should apply patches immediately.

CVE-2025-67038 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-06-23 ·Highlight

CVE-2026-34908: Ubiquiti UniFi OS Vulnerability Added to CISA KEV List

CVE-2026-34908 affects Ubiquiti UniFi OS and requires immediate patching to prevent exploitation.

CVE-2026-34908 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-06-23 ·Highlight

CVE-2026-34909: Ubiquiti UniFi OS Path Traversal Vulnerability Added to CISA KEV List

CVE-2026-34909 affects Ubiquiti UniFi OS; defenders should patch systems immediately.

CVE-2026-34909 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-06-18 ·Highlight

Splunk Enterprise CVE-2026-20253 Added to CISA KEV Catalog

Defenders must upgrade Splunk Enterprise to 10.2.4+ or 10.0.7+ immediately or disable PostgreSQL sidecar service.

CVE-2026-20253 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-06-16 ·Highlight

CISA Adds Joomla JCE Vulnerability to KEV List

Defenders must patch Widget Factory's Joomla Content Editor extension immediately to prevent unauthenticated PHP code execution via the JCE editor profile creation flaw.

CVE-2026-48907 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-06-15 ·Highlight

Cisco Catalyst SD-WAN Manager Path Traversal Vulnerability Added to CISA KEV

Defenders must patch Cisco Catalyst SD-WAN Manager to address CVE-2026-20262 within 14 days of CISA KEV listing.

CVE-2026-20262 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-06-15 ·Highlight

LiteSpeed cPanel Plugin Symlink Vulnerability Added to CISA KEV

CISA added CVE-2026-54420 to KEV; defenders must update LiteSpeed WHM Plugin to 5.3.2.0 or later.

CVE-2026-54420 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-06-12 ·Highlight

Oracle PeopleSoft PeopleTools Critical Auth Bypass Added to CISA KEV

Defenders must patch Oracle PeopleSoft PeopleTools 8.61/8.62 immediately to prevent unauthenticated HTTP takeover.

CVE-2026-35273 auto-generated csurface-intel kev-addition ransomware

CSURFACE Threat Sensor · 2026-06-11

SliceWP Stored XSS Vulnerability CVE-2026-42653 Affects All Versions Through 1.2.6

Defenders must upgrade SliceWP to version 1.2.7 immediately to patch CVE-2026-42653, a stored XSS flaw affecting all versions prior to 1.2.7.

CVE-2026-42653 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-06-11 ·Highlight

Critical SQL Injection in WBW Product Filter Plugin Affects All Versions

Defenders must update WBW Plugins Product Filter by WBW to version 3.1.3 immediately to patch CVE-2026-39494.

CVE-2026-39494 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-06-11 ·Highlight

Beardev JoomSport SQL Injection Vulnerability CVE-2026-42647 Critical

Defenders must update Beardev JoomSport to version 5.7.8 or later to patch CVE-2026-42647.

CVE-2026-42647 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-06-11 ·Highlight

Hippoo Mobile App for WooCommerce Critical Privilege Escalation CVE-2026-49060

Defenders must update Hippoo Mobile App for WooCommerce to version 1.9.5 or later to patch CVE-2026-49060.

CVE-2026-49060 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-06-11 ·Highlight

Ivanti Sentry OS Command Injection (CVE-2026-10520) Added to CISA KEV

Defenders must patch Ivanti Sentry to R10.5.2, R10.6.2, or R10.7.1 immediately.

CVE-2026-10520 auto-generated csurface-intel kev-addition

CSURFACE · 2026-04-21 ·Highlight

We built a second opinion for EPSS — and caught the CVEs it was missing

EPSS is good at what it does. But it has a blind spot: CVEs that quietly land in CISA KEV without ever crossing a high EPSS threshold. CSURFACE's new KEV Prediction score is a second opinion built to catch exactly those.

CVE-2025-43529 CVE-2023-33246 CVE-2025-6558 +4 product research kev-prediction early-warning analysis