News | CSURFACE Threat Sensor

CSURFACE Threat Sensor · 2026-08-18 ·Highlight

CVE-2026-65400: Apple macOS Improper Authentication Vulnerability

CVE-2026-65400 allows network attackers to authenticate to Screen Sharing; update macOS to mitigate.

CVE-2026-65400 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-18 ·Highlight

CISA Adds CVE-2026-33824 to KEV List Amid Exploitation Evidence

CVE-2026-33824 affects Microsoft IKE Service Extensions; defenders should patch immediately.

CVE-2026-33824 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-17 ·Highlight

Critical Vulnerability in MLflow Allows Unauthorized Access to Metadata Services

CVE-2026-64849 affects MLflow versions prior to 3.15.0; upgrade to 3.15.0 to mitigate risk.

CVE-2026-64849 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-17 ·Highlight

CVE-2025-62593: Critical RCE Vulnerability in Ray-Project Code Injection

CVE-2025-62593 exposes Ray users to remote code execution; update to version 2.52.0 immediately.

CVE-2025-62593 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-13 ·Highlight

Critical Vulnerability in WPManageNinja Fluent Forms Pro Affects Version 6.2.7

CVE-2026-73532 exposes WPManageNinja Fluent Forms Pro 6.2.7 to critical risks; update immediately.

CVE-2026-73532 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-13 ·Highlight

Critical vulnerability in WPManageNinja Ninja Tables Pro affects version 5.2.11

CVE-2026-73533 affects WPManageNinja Ninja Tables Pro 5.2.11; defenders should update to the latest version immediately.

CVE-2026-73533 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-13

High-severity CVE-2026-66443 affects Pete Nelson REST API Log

CVE-2026-66443 exposes sensitive data in versions <= 1.7.1; defenders should upgrade immediately.

CVE-2026-66443 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-13

High-severity CVE-2026-66441 affects MultiVendorX versions up to 5.0.10

CVE-2026-66441 exposes unauthenticated broken access control; defenders should update to version 5.0.11 or later.

CVE-2026-66441 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-08-04 ·Highlight

CISA Adds IBM Langflow Code Injection Vulnerability to KEV List

CVE-2026-9198 affects IBM Langflow; defenders should patch to prevent RCE.

CVE-2026-9198 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-04 ·Highlight

CVE-2026-18556: N-able N-central Authentication Bypass Vulnerability

CVE-2026-18556 allows authentication bypass in N-able N-central; defenders should update to version 2026.2 or later.

CVE-2026-18556 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-04 ·Highlight

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Added to CISA KEV List

CVE-2026-34486 affects Apache Tomcat and users should upgrade to the latest versions to mitigate risks.

CVE-2026-34486 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-03 ·Highlight

CVE-2026-18577: Authentication Bypass Vulnerability in N-able N-central

CVE-2026-18577 allows for authentication bypass and account takeover in N-central; defenders should apply patches immediately.

CVE-2026-18577 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-08-02

High-severity CVE-2026-18577 exposes N-able N-central to account takeover

CVE-2026-18577 allows for authentication bypass in N-able N-central; defenders should apply patches immediately.

CVE-2026-18577 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-30 ·Highlight

Exploit for CVE-2026-48907 in Joomla Content Editor Emerges

CVE-2026-48907 allows unauthenticated users to create editor profiles, enabling PHP code execution; update JCE immediately.

CVE-2026-48907 auto-generated csurface-intel exploit-public

CSURFACE Threat Sensor · 2026-07-29 ·Highlight

High-severity CVE-2026-67595 affects VaahCMS versions 2.0.0 to 2.3.4

CVE-2026-67595 affects VaahCMS versions 2.0.0 through 2.3.4; defenders should upgrade to the latest version immediately.

CVE-2026-67595 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-29 ·Highlight

Critical Privilege Escalation Flaw in Joomla Gridbox Extension

CVE-2026-65884 allows unauthenticated users to gain admin access; update to Gridbox version 2.20.2 or later.

CVE-2026-65884 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-29 ·Highlight

Critical Vulnerability in Joomla Gridbox Extension Allows Arbitrary File Uploads

CVE-2026-65885 affects the Gridbox extension for Joomla; update to version 2.20.2 or later immediately.

CVE-2026-65885 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-29 ·Highlight

CISA Adds Cisco Secure Firewall Management Center Vulnerability to KEV List

CVE-2026-20316 affects Cisco Secure Firewall Management Center; update to mitigate risks.

CVE-2026-20316 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-07-27 ·Highlight

Critical Vulnerability in Arista Networks VeloCloud Orchestrator Exposed

CVE-2026-16812 allows remote attackers to access privileged functions; patch immediately.

CVE-2026-16812 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-27

High-severity XSS vulnerability in RexTheme Product Feed Manager

CVE-2026-59553 affects RexTheme Product Feed Manager versions up to 7.6.1; update to the latest version immediately.

CVE-2026-59553 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-27 ·Highlight

Fortinet FortiOS Vulnerability CVE-2025-68686 Added to CISA KEV List

CVE-2025-68686 allows attackers to bypass patches in FortiOS; defenders should apply updates immediately.

CVE-2025-68686 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-07-27 ·Highlight

CVE-2026-16812: Arista VeloCloud Orchestrator OS Command Injection Vulnerability

CVE-2026-16812 affects Arista VeloCloud Orchestrator and requires immediate patching by defenders.

CVE-2026-16812 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-07-22 ·Highlight

Critical Authentication Bypass in Check Point SmartConsole Affects Remote Management

CVE-2026-16232 allows unauthenticated attackers to gain administrative access; defenders should apply patches immediately.

CVE-2026-16232 auto-generated csurface-intel new-disclosure

CSURFACE Threat Sensor · 2026-07-22 ·Highlight

CVE-2026-16232: Check Point SmartConsole Authentication Bypass Vulnerability

CVE-2026-16232 allows unauthenticated attackers to gain administrative access; defenders should restrict Trusted Clients.

CVE-2026-16232 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-07-22 ·Highlight

CISA Adds CVE-2026-50522 to KEV List Amid Exploitation Evidence

CVE-2026-50522 affects Microsoft SharePoint and defenders should apply available patches immediately.

CVE-2026-50522 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-07-21 ·Highlight

CISA Adds DD-WRT Buffer Overflow Vulnerability to KEV List

CVE-2021-27137 affects DD-WRT; users should disable UPnP to mitigate risks.

CVE-2021-27137 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-07-21 ·Highlight

CVE-2026-63030: WordPress Core Vulnerability Allows SQL Injection and RCE

CVE-2026-63030 affects WordPress Core; update to versions 6.9.5 or 7.0.2 immediately.

CVE-2026-63030 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-07-21 ·Highlight

CISA Adds WordPress SQL Injection Vulnerability CVE-2026-60137 to KEV List

CVE-2026-60137 affects WordPress Core and requires immediate patching to prevent SQL Injection attacks.

CVE-2026-60137 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-07-21 ·Highlight

Langflow Remote Code Execution Vulnerability CVE-2026-0770 Added to CISA KEV

CVE-2026-0770 allows remote code execution on Langflow installations; defenders should patch immediately.

CVE-2026-0770 auto-generated csurface-intel kev-addition

CSURFACE Threat Sensor · 2026-07-17 ·Highlight

Critical SQL Injection Vulnerability in WordPress Affects Versions 6.9.x and 7.0.x

CVE-2026-63030 affects WordPress versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2; update immediately.

CVE-2026-63030 auto-generated csurface-intel new-disclosure