News | CSURFACE Threat Sensor

CVE-2025-43529 CVE-2025-14174 active-exploitation zero-day rce cisa-kev kev memory-corruption confirmed-exploited ssvc:attend has-poc severity:HIGH poc-released

CSURFACE · 2025-12-16 ·Highlight

Zero-Day Exploits in Chrome and Safari Prompt Urgent Patches

Google and Apple have patched zero-day vulnerabilities in Chrome and Safari, both actively exploited in the wild.

CVE-2025-14174 CVE-2025-43529 kev has-poc disclosed cisa-kev poc-released active-exploitation rce severity:HIGH ssvc:attend zero-day memory-corruption confirmed-exploited

CSURFACE · 2025-12-10

Ransomware Surge Hits Japanese Manufacturing: Qilin and Kawa4096 Exploit Systems

Japanese manufacturers face rising ransomware attacks from Qilin and Kawa4096, targeting OT and IT systems.

has-threat-actor

CSURFACE · 2025-12-10 ·Highlight

Gogs Zero-Day Exploited in the Wild, Urgent Patch Required

A zero-day vulnerability in Gogs, CVE-2025-8110, is being actively exploited, demanding immediate patching.

CVE-2025-8110 disclosed zero-day ssvc:attend severity:HIGH confirmed-exploited has-poc poc-released active-exploitation cisa-kev breach kev

CSURFACE · 2025-12-09 ·Highlight

Akira Ransomware Exploits SonicWall Vulnerabilities in Ongoing Campaign

Akira ransomware exploits SonicWall vulnerabilities, bypassing MFA to deploy ransomware swiftly.

zero-day ransomware-used vpn campaign breach active-exploitation has-threat-actor

CSURFACE · 2025-12-08 ·Highlight

Critical Zero-Day in King Addons Plugin Exploited for Admin Takeover

A zero-day in King Addons for Elementor allows admin takeover, actively exploited in the wild.

CVE-2025-8489 has-exploit ssvc:attend severity:CRITICAL active-exploitation zero-day priv-esc cms

CSURFACE · 2025-12-04 ·Highlight

Cl0p Ransomware Exploits Critical Oracle E-Business Suite Flaw CVE-2025-61882

Cl0p ransomware exploits critical Oracle E-Business Suite vulnerability CVE-2025-61882, leading to major data breaches.

CVE-2025-61882 ssvc:act poc-released has-exploit zero-day confirmed-exploited has-poc cisa-kev kev has-threat-actor ransomware severity:CRITICAL active-exploitation breach

CSURFACE · 2025-11-26 ·Highlight

Critical Oracle Identity Manager Flaw Exploited in the Wild

A critical flaw in Oracle Identity Manager, CVE-2025-61757, is actively exploited, allowing remote code execution.

CVE-2025-61757 rce cisa-kev kev severity:CRITICAL ssvc:act poc-released active-exploitation zero-day auth-bypass confirmed-exploited has-poc

CSURFACE · 2025-11-26 ·Highlight

Critical Oracle Identity Manager Flaw Actively Exploited in the Wild

A critical vulnerability in Oracle Identity Manager is being actively exploited, allowing unauthenticated access and remote code execution.

CVE-2025-61757 cisa-kev breach kev ssvc:act poc-released active-exploitation rce has-poc severity:CRITICAL auth-bypass confirmed-exploited

CSURFACE · 2025-11-21 ·Highlight

Clop Ransomware Exploits Oracle E-Business Suite 0-Day Vulnerability

Clop ransomware group exploited a zero-day in Oracle E-Business Suite, breaching systems and accessing sensitive data.

zero-day ransomware-used has-threat-actor

CSURFACE · 2025-11-20 ·Highlight

Fortinet FortiWeb Zero-Day CVE-2025-58034 Actively Exploited in the Wild

A zero-day vulnerability in Fortinet FortiWeb, CVE-2025-58034, is actively exploited, prompting urgent patching.

CVE-2025-58034 kev cisa-kev confirmed-exploited has-exploit ssvc:attend severity:HIGH active-exploitation zero-day

CSURFACE · 2025-11-19 ·Highlight

Google Chrome Patches Actively Exploited Zero-Day Vulnerability CVE-2025-13223

Google patched a critical zero-day in Chrome's V8 engine, CVE-2025-13223, actively exploited in the wild.

CVE-2025-13223 rce cisa-kev ssvc:attend severity:HIGH zero-day patched kev confirmed-exploited active-exploitation

CSURFACE · 2025-11-19 ·Highlight

Shinysp1d3r Ransomware-as-a-Service Threatens VMware ESXi Systems

Shinysp1d3r ransomware-as-a-service, linked to ShinyHunters, targets VMware ESXi systems, posing a significant threat to virtualized environments.

breach has-threat-actor

CSURFACE · 2025-11-11 ·Highlight

Samsung Galaxy Devices Targeted by LANDFALL Spyware via Critical Zero-Day

Samsung Galaxy devices are under threat from the LANDFALL spyware, exploiting a critical zero-day vulnerability.

CVE-2025-21042 active-exploitation zero-day rce cisa-kev kev confirmed-exploited poc-released has-poc severity:CRITICAL ssvc:act

CSURFACE · 2025-11-11 ·Highlight

Critical Triofox Vulnerability CVE-2025-12480 Actively Exploited in the Wild

A critical vulnerability in Gladinet's Triofox, CVE-2025-12480, is being actively exploited, prompting urgent patching.

CVE-2025-12480 confirmed-exploited ssvc:act severity:CRITICAL active-exploitation cisa-kev kev

CSURFACE · 2025-11-11 ·Highlight

Critical Triofox Vulnerability CVE-2025-12480 Actively Exploited in the Wild

A critical vulnerability in Triofox, CVE-2025-12480, is being actively exploited, urging immediate patching.

CVE-2025-12480 disclosed active-exploitation cisa-kev kev confirmed-exploited ssvc:act severity:CRITICAL

CSURFACE · 2025-11-05 ·Highlight

Critical RCE Flaw in CentOS Web Panel Actively Exploited

A critical RCE vulnerability in CentOS Web Panel is being actively exploited, urging immediate patching.

CVE-2025-48703 poc-released active-exploitation rce cisa-kev kev confirmed-exploited has-poc severity:CRITICAL ssvc:attend

CSURFACE · 2025-11-02 ·Highlight

Critical CVE-2025-61932 Exploited in Motex Lanscope Endpoint Manager Attacks

CVE-2025-61932, a critical flaw in Motex Lanscope Endpoint Manager, is actively exploited by the Tick Group.

CVE-2025-61932 zero-day cisa-kev kev confirmed-exploited ssvc:act severity:CRITICAL active-exploitation

CSURFACE · 2025-10-28 ·Highlight

Google Chrome Zero-Day CVE-2025-2783 Exploited in Global Cyberattacks

A critical Chrome zero-day, CVE-2025-2783, is being exploited globally, affecting Windows users.

CVE-2025-2783 disclosed poc-released active-exploitation ssvc:attend severity:HIGH zero-day cisa-kev apt-used kev confirmed-exploited has-poc

CSURFACE · 2025-10-25 ·Highlight

Storm-0501 Exploits Critical Adobe Commerce Flaw CVE-2025-54236

Storm-0501 is exploiting a critical Adobe Commerce flaw, CVE-2025-54236, leading to widespread e-commerce breaches.

CVE-2025-54236 active-exploitation cisa-kev kev confirmed-exploited ssvc:act poc-released breach has-exploit has-poc ransomware severity:CRITICAL

CSURFACE · 2025-10-20 ·Highlight

8Base Ransomware Group Strikes Volkswagen, Leaks Sensitive Data

The 8Base ransomware group has attacked Volkswagen, stealing and leaking sensitive data, highlighting the ongoing threat of ransomware.

has-threat-actor ransomware-used breach

CSURFACE · 2025-10-19 ·Highlight

Critical Vulnerability in WatchGuard Fireware OS Exploited in the Wild

A critical vulnerability in WatchGuard Fireware OS, CVE-2025-9242, is being actively exploited, allowing remote code execution.

CVE-2025-9242 poc-released has-poc ssvc:act severity:CRITICAL confirmed-exploited active-exploitation rce cisa-kev vpn kev

CSURFACE · 2025-10-17 ·Highlight

Cisco IOS Zero-Day Exploited for Rootkits and Denial of Service

A Cisco IOS zero-day, CVE-2025-20352, is exploited to plant rootkits and cause DoS, urging immediate patching.

CVE-2025-20352 has-poc poc-released active-exploitation networking kev confirmed-exploited ssvc:attend severity:HIGH zero-day cisa-kev

CSURFACE · 2025-10-15 ·Highlight

Oracle E-Business Suite Vulnerability CVE-2025-61884 Actively Exploited by Ransomware Groups

CVE-2025-61884 in Oracle E-Business Suite is being exploited by ransomware groups, prompting urgent patching.

CVE-2025-61884 active-exploitation zero-day has-threat-actor severity:HIGH ssvc:act cisa-kev kev confirmed-exploited ransomware

CSURFACE · 2025-10-11 ·Highlight

Unpatched Vulnerability in Gladinet CentreStack and Triofox Actively Exploited

A high-severity vulnerability in Gladinet CentreStack and Triofox is being actively exploited, with no patch available.

CVE-2025-11371 severity:HIGH lfi cisa-kev kev confirmed-exploited has-exploit active-exploitation zero-day ssvc:act

CSURFACE · 2025-10-09 ·Highlight

Critical Flaw in WordPress Plugin Allows Admin Account Access

A critical vulnerability in the Service Finder Bookings WordPress plugin allows attackers to access admin accounts.

CVE-2025-5947 active-exploitation cms ssvc:attend severity:CRITICAL

CSURFACE · 2025-10-07 ·Highlight

Storm-1175 Exploits GoAnywhere Zero-Day to Deploy Medusa Ransomware

Storm-1175 exploits a GoAnywhere zero-day to deploy Medusa ransomware, demanding ransoms up to $15 million.

zero-day rce has-threat-actor active-exploitation

CSURFACE · 2025-10-07

Critical 'RediShell' Vulnerability in Redis Allows Remote Code Execution

A critical vulnerability in Redis, CVE-2025-49844, allows remote code execution and has been patched.

CVE-2025-49844 poc-released rce memory-corruption has-poc ssvc:track* severity:CRITICAL

CSURFACE · 2025-10-07 ·Highlight

Zimbra XSS Flaw Exploited to Breach Brazilian Military Systems

A Zimbra XSS vulnerability was exploited to breach Brazilian military systems, prompting urgent patching.

CVE-2025-27915 kev confirmed-exploited active-exploitation zero-day severity:MEDIUM xss cisa-kev ssvc:attend

CSURFACE · 2025-10-03 ·Highlight

CVE-2025-4008: Command Injection Flaw in Meteobridge Actively Exploited

A command injection vulnerability in Meteobridge, CVE-2025-4008, is actively exploited, prompting CISA action.

CVE-2025-4008 kev confirmed-exploited ssvc:attend severity:HIGH active-exploitation cisa-kev