News | CSURFACE Threat Sensor

CSURFACE Threat Sensor · 2026-08-22 ·Highlight

Critical RCE Vulnerability in IBM Langflow OSS Exploited

CVE-2026-9198 allows unauthenticated attackers to achieve full RCE; defenders should patch immediately.

CVE-2026-9198 auto-generated csurface-intel exploit-public

CSURFACE Threat Sensor · 2026-08-21 ·Highlight

Critical SQL Injection Vulnerability in GeoTools Affects Versions 30.5 to 33.5

CVE-2026-76904 affects GeoTools versions 30.5 to 33.5; defenders should upgrade to patched versions immediately.

CVE-2026-76904 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-21 ·Highlight

Critical Vulnerability in SPIP Allows Remote Code Execution

CVE-2026-77806 affects SPIP versions before 4.4.21; update to the latest version immediately.

CVE-2026-77806 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-21 ·Highlight

CISA Adds Zimbra Collaboration Suite OS Command Injection Vulnerability to KEV List

CVE-2026-73570 affects Zimbra Collaboration Suite and requires immediate patching to mitigate risks.

CVE-2026-73570 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-20 ·Highlight

Critical Vulnerability CVE-2026-77647 in SPIP Allows Remote Code Execution

CVE-2026-77647 affects SPIP versions prior to 4.4.20; update immediately to mitigate risks.

CVE-2026-77647 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-20 ·Highlight

Critical CVE-2026-69836 Affects Microsoft Entra: Immediate Action Required

CVE-2026-69836 allows unauthorized code execution in Microsoft Entra; defenders should patch immediately.

CVE-2026-69836 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-20 ·Highlight

CVE-2026-72530: TrueConf Server Code Injection Vulnerability Disclosed

CVE-2026-72530 affects TrueConf Server; defenders should patch immediately.

CVE-2026-72530 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-20 ·Highlight

CISA Adds CVE-2026-72529 to KEV List for TrueConf Server Vulnerability

CVE-2026-72529 exposes TrueConf Server to remote script execution; defenders should patch immediately.

CVE-2026-72529 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-19 ·Highlight

Critical Vulnerability in TrueConf Server Allows Remote Code Execution

CVE-2026-72530 affects TrueConf Server versions 5.3.X to 5.5.5; defenders should patch immediately.

CVE-2026-72530 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-19 ·Highlight

Critical CVE-2026-72529 Affects TrueConf Server, Immediate Action Required

CVE-2026-72529 allows remote attackers to execute arbitrary scripts; defenders should update TrueConf Server immediately.

CVE-2026-72529 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-19 ·Highlight

CVE-2026-64849: MLflow Server-Side Request Forgery Vulnerability

CVE-2026-64849 affects MLflow prior to version 3.15.0; update to the latest version immediately.

CVE-2026-64849 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-18 ·Highlight

CVE-2026-65400: Apple macOS Improper Authentication Vulnerability

CVE-2026-65400 allows network attackers to authenticate to Screen Sharing; update macOS to mitigate.

CVE-2026-65400 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-18 ·Highlight

Broadcom VMware vCenter Path Traversal Vulnerability Added to CISA KEV List

CVE-2026-59310 affects VMware vCenter; defenders should apply patches immediately.

CVE-2026-59310 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-18 ·Highlight

CVE-2026-55040: Microsoft SharePoint Weak Authentication Vulnerability

CVE-2026-55040 exposes SharePoint to unauthorized access; defenders should update immediately.

CVE-2026-55040 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-18 ·Highlight

CISA Adds CVE-2026-33824 to KEV List Amid Exploitation Evidence

CVE-2026-33824 affects Microsoft IKE Service Extensions; defenders should patch immediately.

CVE-2026-33824 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-17 ·Highlight

Critical Vulnerability in MLflow Allows Unauthorized Access to Metadata Services

CVE-2026-64849 affects MLflow versions prior to 3.15.0; upgrade to 3.15.0 to mitigate risk.

CVE-2026-64849 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-17 ·Highlight

CVE-2025-62593: Critical RCE Vulnerability in Ray-Project Code Injection

CVE-2025-62593 exposes Ray users to remote code execution; update to version 2.52.0 immediately.

CVE-2025-62593 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-13 ·Highlight

Critical Vulnerability in WPManageNinja Fluent Forms Pro Affects Version 6.2.7

CVE-2026-73532 exposes WPManageNinja Fluent Forms Pro 6.2.7 to critical risks; update immediately.

CVE-2026-73532 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-13 ·Highlight

Critical vulnerability in WPManageNinja Ninja Tables Pro affects version 5.2.11

CVE-2026-73533 affects WPManageNinja Ninja Tables Pro 5.2.11; defenders should update to the latest version immediately.

CVE-2026-73533 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-13

High-severity CVE-2026-66443 affects Pete Nelson REST API Log

CVE-2026-66443 exposes sensitive data in versions <= 1.7.1; defenders should upgrade immediately.

CVE-2026-66443 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-13

High-severity CVE-2026-66441 affects MultiVendorX versions up to 5.0.10

CVE-2026-66441 exposes unauthenticated broken access control; defenders should update to version 5.0.11 or later.

CVE-2026-66441 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-04 ·Highlight

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Added to CISA KEV List

CVE-2026-34486 affects Apache Tomcat and users should upgrade to the latest versions to mitigate risks.

CVE-2026-34486 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-04 ·Highlight

CVE-2026-18556: N-able N-central Authentication Bypass Vulnerability

CVE-2026-18556 allows authentication bypass in N-able N-central; defenders should update to version 2026.2 or later.

CVE-2026-18556 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-04 ·Highlight

CISA Adds IBM Langflow Code Injection Vulnerability to KEV List

CVE-2026-9198 affects IBM Langflow; defenders should patch to prevent RCE.

CVE-2026-9198 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-03 ·Highlight

CVE-2026-18577: Authentication Bypass Vulnerability in N-able N-central

CVE-2026-18577 allows for authentication bypass and account takeover in N-central; defenders should apply patches immediately.

CVE-2026-18577 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-02

High-severity CVE-2026-18577 exposes N-able N-central to account takeover

CVE-2026-18577 allows for authentication bypass in N-able N-central; defenders should apply patches immediately.

CVE-2026-18577 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-30 ·Highlight

Exploit for CVE-2026-48907 in Joomla Content Editor Emerges

CVE-2026-48907 allows unauthenticated users to create editor profiles, enabling PHP code execution; update JCE immediately.

CVE-2026-48907 auto-generated csurface-intel exploit-public

CSURFACE Threat Sensor · 2026-07-29 ·Highlight

High-severity CVE-2026-67595 affects VaahCMS versions 2.0.0 to 2.3.4

CVE-2026-67595 affects VaahCMS versions 2.0.0 through 2.3.4; defenders should upgrade to the latest version immediately.

CVE-2026-67595 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-29 ·Highlight

Critical Privilege Escalation Flaw in Joomla Gridbox Extension

CVE-2026-65884 allows unauthenticated users to gain admin access; update to Gridbox version 2.20.2 or later.

CVE-2026-65884 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-29 ·Highlight

Critical Vulnerability in Joomla Gridbox Extension Allows Arbitrary File Uploads

CVE-2026-65885 affects the Gridbox extension for Joomla; update to version 2.20.2 or later immediately.

CVE-2026-65885 auto-generated csurface-intel new-disclosure