Release Notes
Start typing to search…

January 20, 2026

Summary

Platform

  • The Censys Assistant AI tool is now available in the Platform web app for all users. Use the assistant to input questions or prompts in a natural language and obtain answers based on the assets and data present in the Censys Internet Map. Learn more about the assistant in the video below.

  • Use the new audit log in the UI or API to review user and organization events for the Platform and user, organization, and workspace events for Attack Surface Management (ASM).

    • The Censys team has started migrating ASM customers to the Platform for organization management. Contact your Censys team representative to learn more about migrating your team.

  • Use personalized fields in the Platform web app to highlight data fields of interest in your search results.

    • Using personalized fields does not filter your search results like the filters on the left side of the page; it simply displays your configured fields on results that have already been returned by your query.

  • You can now target a time range up to 365 days with the get organization credit usage and get organization member credit usage API endpoints.

  • Added an API endpoint to retrieve Free user credit usage information.

Threat Hunting

  • Use the new threat history visual timeline on hosts and web properties to quickly understand previous threat presence on an asset.

    • Hover over a plot line to see the first observed and last observed timestamps. By default, the date range displayed is the previous 30 days. Use the date picker to adjust the displayed range.

New fingerprints

Added the following fingerprints.

Type

Name

Description

Query

software

Open WebUI

This is an Open WebUI web interface.

Platform query

software

Advantech IoTSuite

This is an Advantech IoTSuite system.

Platform query

risk

Exposed Flowise Application

This is an exposed HTTP service running Flowise. This web application provides an interface for building Large Language Models (LLM) workflows and agents. Exposure could lead to data leakage or unauthorized use of the system.

ASM risk query:

risks.name: `Exposed Flowise Application`

risk

Exposed Open WebUI Application

This is an exposed HTTP service running Open WebUI. This web application provides an interface for interacting with Large Language Models (LLM). Exposure could lead to data leakage or unauthorized use of the system.

Asm risk query:

risks.name: `Exposed Open WebUI Application`

January 12, 2026

Summary

Platform

  • Added the following aliases for Platform data fields:
    • threats
    • screenshots
    • sha1
    • org

ASM

  • Several improvements to the ASM web UI were made, including:

    • The workspace selection dropdown is now on the right side of the navigation bar.

    • Icons have been added to many of the items available in the top navigation dropdowns.

    • Scan frequency information is now located at the bottom of the Resources dropdown.

    • Added links to the Integrations dropdown to see all integrations, connected integrations, available integrations, and integrations that need attention.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues.

New fingerprints

Added the following fingerprints.

Type

Name

Description

Query

software

Coolify

This is Coolify, an open-source self-hosted platform for managing servers, applications, and databases.

Platform query

risk

Vulnerable n8n (Ni8mare) [CVE-2026-21858]

This is a service running a version of n8n workflow automation platform that is vulnerable to CVE-2026-21858 (Ni8mare), a critical unauthenticated Remote Code Execution vulnerability caused by a Content-Type confusion flaw in the webhook and file handling mechanism. Attackers can exploit this by sending specially crafted HTTP requests to form-based workflows to read arbitrary files, extract credentials, forge administrator sessions, and execute arbitrary commands..

ASM risk query:

risks.name: `Vulnerable n8n (Ni8mare) [CVE-2026-21858]`

January 5, 2026

Summary

ASM

  • ASM users can now configure their AWS Cloud Connectors to ingest or exclude cloud resources from the ap-east-2, ap-southeast-7, and ap-southeast-6 regions.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issue.

New fingerprints

Added the following fingerprints.

Type

Name

Description

Query

software

HPE OneView

This is an HPE OneView infrastructure management platform.

Platform query

software

Hack the Box

This is a Hack the Box service or endpoint.

Platform query

risk

Unauthenticated NATS Service

A NATS messaging system is exposed without authentication. This allows unauthenticated clients to publish messages to subjects and subscribe to subjects to receive published messages, potentially exposing sensitive data or allowing unauthorized data manipulation.

ASM risk query:

risks.name: `Unauthenticated NATS Service`

risk

Unauthenticated ZeroMQ Service

A ZeroMQ service is exposed without authentication. ZeroMQ services allow unauthenticated clients to connect and interact with the messaging system, which introduces a risk of unintended data exposure or manipulation.

ASM risk query:

risks.name: `Unauthenticated ZeroMQ Service`

risk

Vulnerable SmarterMail [CVE-2025-52691]

This SmarterMail server is running a build version vulnerable to CVE-2025-52691, an arbitrary file upload vulnerability that allows unauthenticated attackers to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. Build versions 9406 and earlier are vulnerable.

ASM risk query:

risks.name: `Vulnerable SmarterMail [CVE-2025-52691]`

risk

Exposed HPE OneView

An HPE OneView infrastructure management application is exposed to the Internet.

ASM risk query:

risks.name: `Exposed HPE OneView`

December 29, 2025

Summary

  • One new Rapid Response advisory, queries, and ASM risk fingerprint for MongoBleed (CVE-2025-14847), a critical MongoDB uninitialized memory disclosure vulnerability.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issue.

New fingerprints

Added the following fingerprint.

Type

Name

Description

Query

risk

MongoBleed: Vulnerable MongoDB [CVE-2025-14847]

This MongoDB server is running a version vulnerable to CVE-2025-14847 (MongoBleed), an unauthenticated memory leak vulnerability that allows remote attackers to exfiltrate sensitive data from the database server's heap memory without requiring credentials.

ASM query:

risks.name="MongoBleed: Vulnerable MongoDB [CVE-2025-14847]"

December 22, 2025

Summary

Platform

Threat Hunting

  • Use the list active threats API endpoint to get a list of active threats observed by Censys.
    • Threats are active if their fingerprint has been identified on hosts or web properties by Censys scans.
    • This endpoint is available to organizations that have access to the Threat Hunting module.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issue.

New fingerprints

Added the following fingerprint.

TypeNameDescriptionQuery
softwareFlowiseThis is a Flowise Server.Platform query

December 15, 2025

Summary

Rapid Response

The Censys Rapid Response team published information about and queries for the following issue.

New fingerprints

Added the following fingerprints.

Type

Name

Description

Query

software

n8n Server

This is a n8n Server, an open-source workflow automation platform with AI integration.

Platform query

software

Apache Tika

This is an Apache Tika Server, a content analysis toolkit.

Platform query

risk

Vulnerable Ivanti Endpoint Manager [CVE-2025-10573]

This is a service running a version of Ivanti Endpoint Manager vulnerable to CVE-2025-10573, a critical Stored Cross-Site Scripting (XSS) vulnerability that allows a remote unauthenticated attacker to execute JavaScript in the context of an administrator's browser session, potentially leading to session hijacking and unauthorized administrative actions.

ASM query:

risks.name: `Vulnerable Ivanti Endpoint Manager [CVE-2025-10573]`

risk

Vulnerable Fortinet Products [CVE-2025-59718, CVE-2025-59719]

This is a Fortinet FortiOS device running a version that is vulnerable to CVE-2025-59718 and CVE-2025-59719, an Improper Verification of Cryptographic Signature vulnerability [CWE-347] that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message, if that feature is enabled on the device.

ASM query:

risks.name: `Vulnerable Fortinet Products [CVE-2025-59718, CVE-2025-59719]`

December 8, 2025

Summary

Platform

  • Some fields are now grouped into aliases to make it easier to search across multiple fields at once. Aliases can be used in the Platform web UI or API. The complete list of aliases and their mapped fields is available in the documentation.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues.

New fingerprints

Added the following fingerprints.

Type

Name

Description

Query

software

Waku

This is a Waku instance.

Platform query

software

pgAdmin 4

This is a pgAdmin 4 instance, a web-based administration tool for PostgreSQL.

Platform query

software

Ferron Web Server

This is a Ferron web server.

Platform query

risk

React2Shell: Unauthenticated RCE in React Server Components [CVE-2025-55182]

This is a critical unauthenticated Remote Code Execution (RCE) flaw, dubbed "React2Shell" caused by insecure deserialization within the Flight protocol used by React Server Components. This risk broadly identifies exposed web services using RSC, but doesn't confirm vulnerability since versions are not available. Users must verify which package versions are running in their environments.

ASM query:

risks.name="React2Shell: Unauthenticated RCE, DoS, and Source Code Leakage in React Server Components [CVE-2025-55182, CVE-2025-55184, CVE-2025-67779, CVE-2025-55183]"

risk

Vulnerable pgAdmin 4 [CVE-2025-12762]

This pgAdmin 4 server is running a version 9.9 or earlier that is vulnerable to CVE-2025-12762, a remote code execution (RCE) vulnerability. When restoring PLAIN-format dump files, an attacker can inject and execute arbitrary commands on the host, potentially leading to full system compromise of the pgAdmin host and downstream database environment.

ASM query:

risks.name: `Vulnerable pgAdmin 4 [CVE-2025-12762]`

November 24, 2025

Summary

  • Added the ability to secure your Platform account with multi-factor authentication. Organization admins can enforce MFA for all members of their organization.
  • Use weekly collection digest emails to track changes to your saved Platform queries over time.
  • Two Rapid Response advisories for XWiki and FortiWeb issues.
  • Added fingerprints for Frigate NVR and XWiki and an ASM risk fingerprint for XWiki instances vulnerable to CVE-2025-24893.

Platform

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues.

New fingerprints

Added the following fingerprints.

Type

Name

Description

Query

software

Frigate NVR

Frigate NVR system.

Platform query

software

XWiki

This is an XWiki server.

Platform query

risk

Vulnerable XWiki [CVE-2025-24893]

XWiki Platform is potentially vulnerable to an unauthenticated remote code execution flaw. If the SolrSearch macro is exposed, an unauthenticated attacker can inject a crafted request into the macro to achieve server-side code execution, which would allow full compromise of the XWiki instance.

ASM query:

risks.name: `Vulnerable XWiki [CVE-2025-24893]`

November 10, 2025

Summary

Platform

New fingerprints

Added the following fingerprint.

TypeNameDescriptionQuery
operating_systemCisco IOS-XE EndpointsThis is a Cisco IOS-XE operating system.Platform query
softwareBazarrBazarr is a companion application to Sonarr and Radarr that manages and downloads subtitles.Platform query
softwareLidarrLidarr is a music collection manager for Usenet and BitTorrent users.Platform query