News | CSURFACE Threat Sensor

CSURFACE · 2026-04-21 ·Highlight

Apache ActiveMQ Vulnerability CVE-2026-34197 Actively Exploited in the Wild

Apache ActiveMQ's CVE-2026-34197 is actively exploited, affecting over 6,000 instances with a critical RCE flaw.

CVE-2026-34197 active-exploitation confirmed-exploited has-poc poc-released rce cisa-kev kev severity:HIGH

CSURFACE · 2026-04-17 ·Highlight

Zero-Day Exploit of CVE-2026-39987 Targets Marimo Users with Blockchain Backdoor

A critical zero-day flaw in Marimo, CVE-2026-39987, is exploited to spread a blockchain backdoor via Hugging Face.

CVE-2026-39987 has-poc severity:CRITICAL poc-released active-exploitation zero-day rce critical

CSURFACE · 2026-04-17 ·Highlight

Zero-Day Exploitation of Marimo RCE CVE-2026-39987 Unleashes Blockchain Backdoor

CVE-2026-39987, a critical Marimo RCE flaw, is exploited as a zero-day to spread a blockchain backdoor via Hugging Face.

CVE-2026-39987 zero-day rce has-poc severity:CRITICAL poc-released active-exploitation

CSURFACE · 2026-04-17 ·Highlight

Apache ActiveMQ Flaw CVE-2026-34197 Actively Exploited, Added to CISA KEV

Apache ActiveMQ's CVE-2026-34197, a high-severity flaw, is actively exploited and now in CISA's KEV catalog.

CVE-2026-34197 active-exploitation rce cisa-kev kev confirmed-exploited has-poc poc-released severity:HIGH

CSURFACE · 2026-04-17 ·Highlight

Critical Nginx UI Flaw CVE-2026-33032 Actively Exploited for Server Takeovers

CVE-2026-33032, a critical Nginx UI flaw, is being actively exploited, allowing unauthenticated server takeovers.

CVE-2026-33032 poc-released active-exploitation has-poc severity:CRITICAL

CSURFACE · 2026-04-17 ·Highlight

Critical CVE-2026-33032 Flaw in Nginx UI Actively Exploited

A critical flaw in Nginx UI, CVE-2026-33032, is being actively exploited, allowing full server takeover.

CVE-2026-33032 has-poc severity:CRITICAL poc-released active-exploitation

CSURFACE · 2026-04-16 ·Highlight

Critical Citrix NetScaler Flaw CVE-2026-3055 Actively Exploited in the Wild

CVE-2026-3055, a critical Citrix NetScaler flaw, is actively exploited, urging immediate patching.

CVE-2026-3055 poc-released active-exploitation cisa-kev critical kev confirmed-exploited has-poc ssvc:act severity:CRITICAL

CSURFACE · 2026-04-13 ·Highlight

Interlock Ransomware Exploits Cisco FMC Zero-Day in Active Campaign

Interlock ransomware group exploits a zero-day in Cisco's Firepower Management Center, targeting enterprise firewalls.

campaign has-threat-actor active-exploitation zero-day

CSURFACE · 2026-04-09 ·Highlight

Critical RCE Flaw in FlowiseAI Actively Exploited in the Wild

A critical RCE vulnerability in FlowiseAI's platform is being actively exploited, posing severe risks.

CVE-2025-59528 ssvc:attend severity:CRITICAL poc-released active-exploitation rce has-exploit has-poc

CSURFACE · 2026-04-06

Critical Flaw in ShareFile Storage Zones Controller Allows Remote Code Execution

A critical vulnerability in ShareFile Storage Zones Controller allows remote code execution, urging immediate patching.

CVE-2026-2699 poc-released rce has-poc severity:CRITICAL

CSURFACE · 2026-04-04 ·Highlight

Anubis Ransomware Evolves with Destructive Wiper Capability

Anubis ransomware now includes a wiper module, permanently deleting files and increasing pressure on victims.

ransomware-used has-threat-actor

CSURFACE · 2026-04-04 ·Highlight

Anubis Ransomware Intensifies with Destructive Wiper Capabilities

Anubis ransomware now includes a wiper, destroying files beyond recovery to pressure victims.

ransomware-used breach has-threat-actor

CSURFACE · 2026-04-03 ·Highlight

Google Chrome Zero-Day CVE-2026-5281 Actively Exploited, Patch Released

Google has patched a critical zero-day vulnerability in Chrome, CVE-2026-5281, actively exploited in the wild.

CVE-2026-5281 has-poc severity:HIGH poc-released active-exploitation patched zero-day kev confirmed-exploited disclosed rce ssvc:attend memory-corruption cisa-kev breach

CSURFACE · 2026-04-02 ·Highlight

Critical React2Shell Vulnerability Exploited in Ransomware Attacks

CVE-2025-55182, a critical React Server Components vulnerability, is being exploited in ransomware attacks, prompting urgent patching.

CVE-2025-55182 active-exploitation auth-bypass has-poc ssvc:act zero-day breach kev confirmed-exploited ransomware poc-released rce deserialization cisa-kev has-exploit severity:CRITICAL

CSURFACE · 2026-03-31 ·Highlight

Critical RCE Vulnerability in F5 BIG-IP Exploited in the Wild

A critical RCE vulnerability in F5 BIG-IP is actively exploited, urging immediate patching.

CVE-2025-53521 kev confirmed-exploited ssvc:act severity:CRITICAL rce memory-corruption cisa-kev active-exploitation

CSURFACE · 2026-03-30 ·Highlight

Critical Cisco FMC Flaw Exploited by Interlock Ransomware for Root Access

Interlock ransomware exploits critical Cisco FMC flaw CVE-2026-20131 for root access, urging immediate patching.

CVE-2026-20131 active-exploitation rce firewall kev confirmed-exploited poc-released deserialization cisa-kev has-threat-actor severity:CRITICAL disclosed zero-day critical has-poc ransomware ssvc:act

CSURFACE · 2026-03-25 ·Highlight

Critical CVE-2026-21962 Exploited in the Wild Targets Oracle Middleware

CVE-2026-21962, a critical flaw in Oracle Middleware, is actively exploited, urging immediate patching.

CVE-2026-21962 poc-released active-exploitation has-poc ssvc:attend severity:CRITICAL

CSURFACE · 2026-03-23 ·Highlight

Quest KACE SMA Vulnerability CVE-2025-32975 Actively Exploited in the Wild

A critical authentication bypass flaw in Quest KACE SMA, CVE-2025-32975, is actively exploited, urging immediate patching.

CVE-2025-32975 cisa-kev critical kev confirmed-exploited severity:CRITICAL active-exploitation auth-bypass

CSURFACE · 2026-03-20 ·Highlight

Zero-Day Exploit Targets ConnectWise ScreenConnect Servers

A zero-day vulnerability in ConnectWise ScreenConnect is being actively exploited, risking unauthorized access.

CVE-2026-3564 active-exploitation zero-day ssvc:track severity:CRITICAL

CSURFACE · 2026-03-20 ·Highlight

Critical Langflow Vulnerability CVE-2026-33017 Exploited as Zero-Day

Langflow's CVE-2026-33017, a critical zero-day flaw, is actively exploited, allowing unauthorized AI workflow creation.

CVE-2026-33017 confirmed-exploited poc-released zero-day cisa-kev kev severity:CRITICAL active-exploitation has-poc ssvc:act

CSURFACE · 2026-03-20 ·Highlight

Google Chrome Zero-Day CVE-2026-2441 Actively Exploited, Patch Released

Google patched a high-severity zero-day vulnerability in Chrome, CVE-2026-2441, actively exploited in the wild.

CVE-2026-2441 kev confirmed-exploited ssvc:attend poc-released patched memory-corruption cisa-kev active-exploitation zero-day has-poc severity:HIGH

CSURFACE · 2026-03-19 ·Highlight

Zimbra XSS Vulnerability Exploited by Russian APT in Ukraine

A Russian APT is exploiting a Zimbra XSS flaw to target Ukraine, prompting urgent patching.

CVE-2025-66376 active-exploitation apt-used kev severity:MEDIUM xss cisa-kev confirmed-exploited ssvc:attend

CSURFACE · 2026-03-13 ·Highlight

Google Chrome V8 Zero-Day Exploited in the Wild Before Disclosure

A zero-day flaw in Chrome's V8 engine, CVE-2026-3910, was exploited before disclosure, prompting urgent patching.

CVE-2026-3910 zero-day kev ssvc:attend severity:HIGH confirmed-exploited disclosed active-exploitation memory-corruption cisa-kev

CSURFACE · 2026-03-09 ·Highlight

Critical Flaw in Nginx UI Exposes Server Backups to Unauthenticated Attackers

CVE-2026-27944 in Nginx UI allows unauthenticated access to server backups, actively exploited.

CVE-2026-27944 poc-released active-exploitation breach has-poc ssvc:attend severity:CRITICAL

CSURFACE · 2026-03-06 ·Highlight

Cisco Catalyst SD-WAN Manager Vulnerability Actively Exploited

A vulnerability in Cisco Catalyst SD-WAN Manager is being actively exploited, allowing attackers to overwrite files.

CVE-2026-20122 active-exploitation cisa-kev kev confirmed-exploited severity:MEDIUM

CSURFACE · 2026-03-05 ·Highlight

Zero-Click RCE Vulnerability in FreeScout Exploited in the Wild

A zero-click RCE vulnerability in FreeScout is being actively exploited, allowing attackers to execute code remotely.

CVE-2026-28289 has-exploit has-poc ssvc:track* active-exploitation rce breach severity:HIGH poc-released

CSURFACE · 2026-03-04 ·Highlight

CVE-2026-22719 Exploited in VMware Aria Operations, Added to CISA KEV

VMware Aria Operations flaw CVE-2026-22719 is actively exploited, now in CISA's KEV catalog.

CVE-2026-22719 rce cisa-kev kev confirmed-exploited ssvc:attend severity:HIGH active-exploitation

CSURFACE · 2026-03-02 ·Highlight

APT28 Exploits Microsoft Windows Zero-Day CVE-2026-21513

APT28 exploited a zero-day in Windows 10, CVE-2026-21513, before its disclosure, prompting urgent patching.

CVE-2026-21513 cisa-kev kev ransomware ssvc:attend severity:HIGH active-exploitation zero-day apt-used confirmed-exploited

CSURFACE · 2026-03-01 ·Highlight

CVE-2025-64328 Exploited in Over 900 Sangoma FreePBX Instances

A command injection flaw in Sangoma FreePBX has been exploited in over 900 instances, prompting urgent patching.

CVE-2025-64328 poc-released kev confirmed-exploited has-exploit severity:HIGH active-exploitation cisa-kev has-poc ssvc:attend