News | CSURFACE Threat Sensor

CSURFACE · 2025-10-28 ·Highlight

Google Chrome Zero-Day CVE-2025-2783 Exploited in Global Cyberattacks

A critical Chrome zero-day, CVE-2025-2783, is being exploited globally, affecting Windows users.

CVE-2025-2783 disclosed poc-released active-exploitation ssvc:attend severity:HIGH zero-day cisa-kev apt-used kev confirmed-exploited has-poc

CSURFACE · 2025-10-25 ·Highlight

Storm-0501 Exploits Critical Adobe Commerce Flaw CVE-2025-54236

Storm-0501 is exploiting a critical Adobe Commerce flaw, CVE-2025-54236, leading to widespread e-commerce breaches.

CVE-2025-54236 active-exploitation cisa-kev kev confirmed-exploited ssvc:act poc-released breach has-exploit has-poc ransomware severity:CRITICAL

CSURFACE · 2025-10-20 ·Highlight

8Base Ransomware Group Strikes Volkswagen, Leaks Sensitive Data

The 8Base ransomware group has attacked Volkswagen, stealing and leaking sensitive data, highlighting the ongoing threat of ransomware.

has-threat-actor ransomware-used breach

CSURFACE · 2025-10-19 ·Highlight

Critical Vulnerability in WatchGuard Fireware OS Exploited in the Wild

A critical vulnerability in WatchGuard Fireware OS, CVE-2025-9242, is being actively exploited, allowing remote code execution.

CVE-2025-9242 poc-released has-poc ssvc:act severity:CRITICAL confirmed-exploited active-exploitation rce cisa-kev vpn kev

CSURFACE · 2025-10-17 ·Highlight

Cisco IOS Zero-Day Exploited for Rootkits and Denial of Service

A Cisco IOS zero-day, CVE-2025-20352, is exploited to plant rootkits and cause DoS, urging immediate patching.

CVE-2025-20352 has-poc poc-released active-exploitation networking kev confirmed-exploited ssvc:attend severity:HIGH zero-day cisa-kev

CSURFACE · 2025-10-15 ·Highlight

Oracle E-Business Suite Vulnerability CVE-2025-61884 Actively Exploited by Ransomware Groups

CVE-2025-61884 in Oracle E-Business Suite is being exploited by ransomware groups, prompting urgent patching.

CVE-2025-61884 active-exploitation zero-day has-threat-actor severity:HIGH ssvc:act cisa-kev kev confirmed-exploited ransomware

CSURFACE · 2025-10-11 ·Highlight

Unpatched Vulnerability in Gladinet CentreStack and Triofox Actively Exploited

A high-severity vulnerability in Gladinet CentreStack and Triofox is being actively exploited, with no patch available.

CVE-2025-11371 severity:HIGH lfi cisa-kev kev confirmed-exploited has-exploit active-exploitation zero-day ssvc:act

CSURFACE · 2025-10-09 ·Highlight

Critical Flaw in WordPress Plugin Allows Admin Account Access

A critical vulnerability in the Service Finder Bookings WordPress plugin allows attackers to access admin accounts.

CVE-2025-5947 active-exploitation cms ssvc:attend severity:CRITICAL

CSURFACE · 2025-10-07 ·Highlight

Storm-1175 Exploits GoAnywhere Zero-Day to Deploy Medusa Ransomware

Storm-1175 exploits a GoAnywhere zero-day to deploy Medusa ransomware, demanding ransoms up to $15 million.

zero-day rce has-threat-actor active-exploitation

CSURFACE · 2025-10-07

Critical 'RediShell' Vulnerability in Redis Allows Remote Code Execution

A critical vulnerability in Redis, CVE-2025-49844, allows remote code execution and has been patched.

CVE-2025-49844 poc-released rce memory-corruption has-poc ssvc:track* severity:CRITICAL

CSURFACE · 2025-10-07 ·Highlight

Zimbra XSS Flaw Exploited to Breach Brazilian Military Systems

A Zimbra XSS vulnerability was exploited to breach Brazilian military systems, prompting urgent patching.

CVE-2025-27915 kev confirmed-exploited active-exploitation zero-day severity:MEDIUM xss cisa-kev ssvc:attend

CSURFACE · 2025-10-03 ·Highlight

CVE-2025-4008: Command Injection Flaw in Meteobridge Actively Exploited

A command injection vulnerability in Meteobridge, CVE-2025-4008, is actively exploited, prompting CISA action.

CVE-2025-4008 kev confirmed-exploited ssvc:attend severity:HIGH active-exploitation cisa-kev

CSURFACE · 2025-09-24 ·Highlight

Libraesva ESG Vulnerability Exploited in the Wild Within Days of Disclosure

A command injection flaw in Libraesva ESG is actively exploited, prompting urgent patching.

CVE-2025-59689 severity:MEDIUM active-exploitation zero-day cisa-kev kev confirmed-exploited ssvc:attend

CSURFACE · 2025-09-18 ·Highlight

Google Patches Actively Exploited Chrome Zero-Day CVE-2025-10585

Google patched a critical Chrome zero-day, CVE-2025-10585, actively exploited before disclosure.

CVE-2025-10585 confirmed-exploited has-poc severity:CRITICAL zero-day kev cisa-kev ssvc:act poc-released active-exploitation

CSURFACE · 2025-09-18 ·Highlight

Google Patches Actively Exploited Chrome Zero-Day CVE-2025-10585

Google has patched a critical zero-day vulnerability in Chrome, CVE-2025-10585, actively exploited in the wild.

CVE-2025-10585 kev severity:CRITICAL poc-released zero-day cisa-kev active-exploitation confirmed-exploited has-poc ssvc:act

CSURFACE · 2025-09-17 ·Highlight

Apple Patches Critical Zero-Day Exploited in Sophisticated Attacks

Apple has patched a critical zero-day vulnerability in iOS, iPadOS, and macOS, actively exploited in sophisticated attacks.

CVE-2025-43300 has-poc disclosed active-exploitation cisa-kev kev confirmed-exploited ssvc:act severity:CRITICAL poc-released zero-day

CSURFACE · 2025-09-14 ·Highlight

Samsung Patches Critical Zero-Day CVE-2025-21043 Exploited in the Wild

Samsung patched a critical zero-day vulnerability, CVE-2025-21043, affecting mobile devices, which was actively exploited in the wild.

CVE-2025-21043 kev confirmed-exploited ssvc:act severity:CRITICAL active-exploitation zero-day cisa-kev

CSURFACE · 2025-09-14 ·Highlight

Critical Deserialization Flaw in DELMIA Apriso Actively Exploited

A critical deserialization vulnerability in DELMIA Apriso is actively exploited, prompting urgent mitigation.

CVE-2025-5086 rce cisa-kev severity:CRITICAL active-exploitation deserialization kev confirmed-exploited ssvc:attend

CSURFACE · 2025-09-10 ·Highlight

Critical FreePBX Vulnerability Exploited in the Wild

A critical FreePBX vulnerability is actively exploited, allowing remote code execution and database manipulation.

CVE-2025-57819 active-exploitation cisa-kev kev has-exploit has-poc poc-released weaponized severity:CRITICAL ssvc:act rce confirmed-exploited

CSURFACE · 2025-09-04 ·Highlight

Critical Sitecore Vulnerability CVE-2025-53690 Actively Exploited

A critical deserialization flaw in Sitecore XM and XP, CVE-2025-53690, is being actively exploited.

CVE-2025-53690 poc-released active-exploitation zero-day has-poc ssvc:attend severity:CRITICAL cisa-kev kev confirmed-exploited

CSURFACE · 2025-09-04 ·Highlight

TP-Link Router Vulnerabilities CVE-2023-50224 and CVE-2025-9377 Actively Exploited

Two actively exploited vulnerabilities in TP-Link routers, CVE-2023-50224 and CVE-2025-9377, demand urgent attention.

CVE-2023-50224 CVE-2025-9377 confirmed-exploited severity:HIGH rce networking info-disclosure kev zero-day ssvc:attend severity:MEDIUM active-exploitation cisa-kev

CSURFACE · 2025-09-02 ·Highlight

WhatsApp Zero-Click Exploit CVE-2025-55177 Actively Targeting Apple Devices

A zero-click vulnerability in WhatsApp, CVE-2025-55177, is actively exploited on Apple devices, prompting urgent updates.

CVE-2025-55177 active-exploitation cisa-kev kev confirmed-exploited ssvc:attend severity:MEDIUM

CSURFACE · 2025-08-29 ·Highlight

Critical CrushFTP Vulnerability CVE-2025-54309 Actively Exploited in the Wild

CVE-2025-54309 in CrushFTP is being actively exploited, allowing remote admin access; patch immediately.

CVE-2025-54309 active-exploitation zero-day cisa-kev critical severity:CRITICAL poc-released kev confirmed-exploited has-poc ssvc:act

CSURFACE · 2025-08-29 ·Highlight

Critical CrushFTP Vulnerability CVE-2025-54309 Actively Exploited

A critical vulnerability in CrushFTP, CVE-2025-54309, is being actively exploited, allowing attackers to gain admin access.

CVE-2025-54309 kev has-poc ssvc:act severity:CRITICAL active-exploitation zero-day cisa-kev poc-released confirmed-exploited

CSURFACE · 2025-08-28 ·Highlight

Critical Zero-Day CVE-2025-7775 Exploited in Citrix NetScaler Devices

A critical zero-day vulnerability, CVE-2025-7775, affecting Citrix NetScaler devices, is being actively exploited, necessitating immediate patching.

CVE-2025-7775 active-exploitation rce confirmed-exploited kev has-poc ssvc:act severity:CRITICAL poc-released zero-day cisa-kev

CSURFACE · 2025-08-26 ·Highlight

Active Exploitation of Git Vulnerability CVE-2025-48384 Prompts Urgent Patching

A high-severity Git vulnerability, CVE-2025-48384, is actively exploited, urging immediate patching.

CVE-2025-48384 poc-released confirmed-exploited ssvc:attend severity:HIGH active-exploitation cisa-kev kev has-poc

CSURFACE · 2025-08-16 ·Highlight

Critical Command Injection Flaw in Fortinet FortiSIEM Exploited in the Wild

A critical command injection vulnerability in Fortinet FortiSIEM is being actively exploited, prompting urgent patching.

CVE-2025-25256 poc-released active-exploitation breach has-poc ssvc:attend severity:CRITICAL

CSURFACE · 2025-08-14 ·Highlight

Zero-Day Exploit Targets N-able N-central with Command Injection Vulnerability

A zero-day vulnerability in N-able N-central, CVE-2025-8876, is actively exploited, allowing OS command injection.

CVE-2025-8876 disclosed zero-day rce confirmed-exploited active-exploitation cisa-kev kev ssvc:attend severity:HIGH