News | CSURFACE Threat Sensor

CSURFACE · 2025-05-14 ·Highlight

Critical SAP NetWeaver Flaw Exploited in the Wild

A critical SAP NetWeaver vulnerability is being actively exploited, urging immediate patching.

CVE-2025-42999 kev confirmed-exploited ssvc:attend severity:CRITICAL active-exploitation rce cisa-kev

CSURFACE · 2025-05-14 ·Highlight

Samsung MagicINFO 9 Server Exploit Used to Deploy Mirai Botnet

Samsung patched a critical MagicINFO 9 Server flaw exploited to deploy the Mirai botnet.

CVE-2025-4632 confirmed-exploited ssvc:act severity:CRITICAL poc-released zero-day kev has-poc active-exploitation cisa-kev

CSURFACE · 2025-05-14 ·Highlight

Samsung MagicINFO 9 Server Flaw Exploited to Deploy Mirai Botnet

Samsung patched a critical vulnerability in MagicINFO 9 Server exploited to deploy the Mirai botnet.

CVE-2025-4632 active-exploitation kev confirmed-exploited ssvc:act severity:CRITICAL poc-released zero-day cisa-kev has-poc

CSURFACE · 2025-05-08 ·Highlight

Critical Cisco IOS XE Flaw Allows Remote File Uploads, Patched

Cisco patches critical IOS XE flaw allowing remote file uploads, urging immediate updates.

CVE-2025-20188 severity:CRITICAL active-exploitation breach ssvc:track*

CSURFACE · 2025-05-08 ·Highlight

SysAid On-Prem XXE Flaw Actively Exploited in the Wild

A high-severity XXE vulnerability in SysAid On-Prem is being actively exploited, risking admin account takeovers.

CVE-2025-2775 poc-released active-exploitation kev confirmed-exploited has-poc ssvc:act severity:HIGH cisa-kev

CSURFACE · 2025-05-07 ·Highlight

FreeType Vulnerability CVE-2025-27363 Actively Exploited, Patch Available

A critical FreeType vulnerability, CVE-2025-27363, is being actively exploited, prompting urgent patching.

CVE-2025-27363 has-poc severity:HIGH poc-released active-exploitation cisa-kev kev confirmed-exploited ssvc:attend

CSURFACE · 2025-05-02 ·Highlight

Exploited Flaws in SonicWall and Apache Servers Pose Critical Risks

Critical vulnerabilities in SonicWall and Apache servers are being actively exploited, urging immediate patching.

CVE-2024-38475 CVE-2023-44221 has-poc severity:CRITICAL cisa-kev active-exploitation kev confirmed-exploited ssvc:attend poc-released ransomware ssvc:act severity:HIGH

CSURFACE · 2025-05-01 ·Highlight

Commvault Web Server Exploit Used in Azure Breach

Hackers exploited CVE-2025-3928 in Commvault Web Server during an Azure breach, prompting urgent patching.

CVE-2025-3928 zero-day cisa-kev kev confirmed-exploited ssvc:attend severity:HIGH active-exploitation

CSURFACE · 2025-04-25 ·Highlight

Critical Ivanti Connect Secure Flaw CVE-2025-0282 Exploited in Ransomware Attacks

A critical vulnerability in Ivanti Connect Secure, CVE-2025-0282, is being actively exploited by ransomware groups, prompting urgent patching.

CVE-2025-0282 disclosed poc-released ransomware zero-day ssvc:attend memory-corruption kev confirmed-exploited has-poc active-exploitation cisa-kev has-exploit severity:CRITICAL

CSURFACE · 2025-04-24 ·Highlight

Critical RCE Vulnerability in Commvault Command Center Actively Exploited

A critical RCE vulnerability in Commvault Command Center is being actively exploited, urging immediate patching.

CVE-2025-34028 active-exploitation cisa-kev kev confirmed-exploited has-poc ssvc:act poc-released lfi severity:CRITICAL

CSURFACE · 2025-04-22 ·Highlight

Critical RCE Vulnerability in Erlang/OTP SSH Exploited in the Wild

A critical RCE vulnerability in Erlang/OTP's SSH server is being actively exploited, urging immediate patching.

CVE-2025-32433 confirmed-exploited has-exploit severity:CRITICAL cisa-kev critical kev has-poc ssvc:act poc-released active-exploitation rce

CSURFACE · 2025-04-17 ·Highlight

Apple Patches Critical Zero-Day Vulnerabilities Exploited in the Wild

Apple has patched two critical zero-day vulnerabilities, CVE-2025-31200 and CVE-2025-31201, actively exploited in the wild.

CVE-2025-31200 CVE-2025-31201 zero-day kev confirmed-exploited has-poc ssvc:act poc-released active-exploitation severity:CRITICAL cisa-kev

CSURFACE · 2025-04-17 ·Highlight

Critical RCE Flaw in Gladinet CentreStack Actively Exploited

A critical RCE vulnerability in Gladinet CentreStack is being actively exploited, urging immediate patching.

CVE-2025-30406 poc-released cisa-kev kev confirmed-exploited has-exploit has-poc active-exploitation patched rce ssvc:act severity:CRITICAL

CSURFACE · 2025-04-08 ·Highlight

Critical CrushFTP Vulnerability CVE-2025-31161 Actively Exploited by Ransomware

CVE-2025-31161, a critical CrushFTP flaw, is exploited by ransomware, urging immediate patching.

CVE-2025-31161 kev active-exploitation cisa-kev breach ransomware ssvc:act severity:CRITICAL poc-released confirmed-exploited has-poc

CSURFACE · 2025-03-30 ·Highlight

Critical Apache Tomcat Vulnerability CVE-2025-24813 Actively Exploited by Iranian Group

A critical Apache Tomcat vulnerability, CVE-2025-24813, is being actively exploited by Iranian IRGC-linked attackers, allowing remote code execution.

CVE-2025-24813 has-poc severity:CRITICAL poc-released kev confirmed-exploited ransomware rce cisa-kev ssvc:act has-exploit disclosed active-exploitation info-disclosure breach

CSURFACE · 2025-03-29

Researchers Exploit Vulnerability to Expose BlackLock Ransomware Operations

Researchers exploited a vulnerability in BlackLock ransomware's leak site, exposing the group's operations.

phishing has-threat-actor

CSURFACE · 2025-03-26 ·Highlight

Critical Kubernetes Ingress-NGINX Flaw Allows Remote Code Execution

CVE-2025-1974 in Kubernetes ingress-nginx allows remote code execution, urging immediate patching.

CVE-2025-1974 ssvc:attend severity:CRITICAL disclosed active-exploitation container poc-released rce has-poc

CSURFACE · 2025-03-26 ·Highlight

Critical Authentication Bypass Flaws in Kentico Xperience Exploited in the Wild

Two critical authentication bypass vulnerabilities in Kentico Xperience are being actively exploited, urging immediate patching.

CVE-2025-2746 CVE-2025-2747 ssvc:act severity:CRITICAL auth-bypass cisa-kev kev active-exploitation confirmed-exploited

CSURFACE · 2025-03-26 ·Highlight

Critical Kubernetes Flaw CVE-2025-1974 Allows Remote Code Execution

CVE-2025-1974 in Kubernetes' ingress-nginx allows remote code execution, demanding urgent patching.

CVE-2025-1974 poc-released rce breach active-exploitation container has-poc ssvc:attend severity:CRITICAL

CSURFACE · 2025-03-25

Arkana Ransomware Strikes WideOpenWest, Disrupting Services

Arkana ransomware attack disrupts WideOpenWest services, highlighting critical infrastructure vulnerabilities.

has-threat-actor

CSURFACE · 2025-03-17

Apos Security Ransomware Hits KIU System Solutions

Apos Security ransomware attack disrupts operations at KIU System Solutions.

has-threat-actor

CSURFACE · 2025-03-17

Cactus Ransomware Group Claims Two New Victims on Dark Web

Cactus ransomware group lists two new victims on its dark web portal, highlighting ongoing ransomware threats.

ransomware-used has-threat-actor

CSURFACE · 2025-03-14 ·Highlight

Apple Patches Critical Safari Zero-Day Exploited in the Wild

Apple has patched a critical Safari zero-day vulnerability, CVE-2025-24201, actively exploited in the wild.

CVE-2025-24201 confirmed-exploited ssvc:act severity:CRITICAL poc-released zero-day breach active-exploitation cisa-kev kev has-poc

CSURFACE · 2025-03-07 ·Highlight

Critical Flaw in Edimax IP Cameras Exploited by Mirai Botnets

Mirai botnets exploit critical Edimax IP camera flaw for remote code execution.

CVE-2025-1316 kev confirmed-exploited active-exploitation rce ssvc:act severity:CRITICAL zero-day cisa-kev

CSURFACE · 2025-03-04 ·Highlight

Active Exploitation of PostgreSQL SQL Injection Flaw CVE-2025-1094

PostgreSQL's CVE-2025-1094 SQL injection flaw is actively exploited, risking arbitrary code execution.

CVE-2025-1094 has-poc ssvc:track* poc-released zero-day rce database active-exploitation sqli has-exploit severity:HIGH

CSURFACE · 2025-03-04 ·Highlight

PostgreSQL SQL Injection Flaw CVE-2025-1094 Exploited in US Treasury Hack

A high-severity SQL injection flaw in PostgreSQL, CVE-2025-1094, was exploited in a US Treasury hack.

CVE-2025-1094 zero-day has-poc ssvc:track* severity:HIGH poc-released active-exploitation rce sqli database has-exploit

CSURFACE · 2025-02-20 ·Highlight

Palo Alto Networks PAN-OS Vulnerability CVE-2025-0111 Actively Exploited

CVE-2025-0111 in Palo Alto Networks PAN-OS is actively exploited, allowing file access via the management interface.

CVE-2025-0111 active-exploitation cisa-kev firewall kev confirmed-exploited ssvc:attend severity:MEDIUM

CSURFACE · 2025-02-20 ·Highlight

Palo Alto Networks PAN-OS Flaws Exploited in Active Ransomware Campaigns

Two critical vulnerabilities in Palo Alto Networks' PAN-OS are being actively exploited, linked to ransomware campaigns.

CVE-2025-0108 CVE-2024-9474 poc-released zero-day kev has-exploit severity:CRITICAL auth-bypass ransomware severity:HIGH cisa-kev confirmed-exploited has-poc ssvc:attend ssvc:act active-exploitation priv-esc firewall

CSURFACE · 2025-02-19 ·Highlight

Trimble Cityworks Vulnerability CVE-2025-0994 Actively Exploited

Trimble Cityworks vulnerability CVE-2025-0994 is being actively exploited, allowing remote code execution.

CVE-2025-0994 confirmed-exploited ssvc:attend poc-released rce deserialization cisa-kev kev active-exploitation has-poc severity:HIGH