November 2, 2026
about 2 hours ago
Summary
- For Free and Starter users, all actions in the Censys UI and API cost one credit each. Your monthly credit allotment now lets you perform more actions in the UI and API than before. Additionally, every Free and Starter user now gets five free Platform actions per day.
- You can now purchase a monthly Censys Starter or Censys Starter Pro subscription. Each Starter tier has the same data access but includes a different monthly credit allotment and collection and tag count.
- You can no longer purchase Censys Credit packs.
- Added two new fingerprints to the Platform and two new risk fingerprints to ASM.
- Five new Censys ARC Rapid Response Advisories.
Platform
- The credit cost for every action a Censys Free or Censys Starter has been changed to one credit each.
- Previously, a lookup cost one credit, a standard search query cost five credits, and an advanced (regex) query cost eight credits.
- As a result of this flattening of credit costs, your monthly credit allotment now lets you perform more actions in the UI and API than before.
- Additionally, every Free and Starter user now gets five free Platform actions per day.
- Learn more about Censys Credits in our updated documentation.
- You can now purchase a monthly Censys Starter or Censys Starter Pro subscription.
- Each Starter tier receives additional monthly credits and expanded feature and data access.
- The price and credit allotment for each plan is shown in the table below.
Subscription Plan Price per month (US dollar) Censys Credits per month Censys Starter $79 500 Censys Starter Pro $599 4,000 - Monthly credits for a Censys Starter subscription have a one-month rollover.
- When you purchase a Censys Starter subscription, you instantly gain access to additional API endpoints like search, aggregate, and all collections endpoints. You also get access to tags and comments and a varying number of full-size collections based on your subscription tier. Censys Starter Pro users have access to more collections and more tags.
- For a complete list of features and data available to Censys Starter users, review the Feature and Data Access Tiers page.
- To purchase a Censys Starter plan, go to the Plan page in the Platform web console.
- You can no longer purchase Censys Credit packs.
New fingerprints and risks
Added two new fingerprints to the Platform and two new risk fingerprint to ASM.
Note that new ASM risk fingerprints may be disabled by default in your workspace. Reference your risk type configuration in the ASM web console to review new risk types.
New fingerprints
| Type | Name | Description | Query |
|---|---|---|---|
| software | Wordpress Plugin - Gravity Forms | A WordPress plugin designed for building complex web forms and automating data-collection workflows. | Platform query |
| OS | Cisco NX-OS | A network operating system built on Linux designed for enterprise data center switches, cloud networks, and storage area networks (SANs). | Platform query |
New risks
| Name | Description | Query |
|---|---|---|
| Vulnerable Gravity Forms [CVE-2026-103039] | Gravity Forms 3.1.2 or earlier, affected by CVE-2026-103039, an unauthenticated PHP object injection. Requires a public form with a List-type Post Custom Field using a content template, and remote code execution also needs a gadget chain. This risk reflects the version only and cannot confirm whether your forms use that field. | |
| Vulnerable Gravity Forms [CVE-2026-84434] | Gravity Forms 3.1.0.4 or earlier, affected by CVE-2026-84434, an unauthenticated file upload that can lead to remote code execution. Requires a public form with a hidden File Upload field. This risk reflects the version only and cannot confirm whether your forms use that field. | |
Censys ARC Rapid Response
The Censys ARC team published information about the following issues.
- Oct 27 Advisory: Google Brotli Decoder Out-of-Bounds Write [CVE-2026-111497]
- Oct 28 Advisory: Oracle E-Business Suite Unauthenticated Takeover [CVE-2026-101767]
- Oct 29 Advisory: Drupal Core Field UI Remote Code Execution [CVE-2026-108097]
- Oct 30 Advisory: Progress WS_FTP Server Improper Authentication and Related Vulnerabilities [CVE-2026-84295 and Others]
- Oct 30 Advisory: Gravity Forms PHP Object Injection [CVE-2026-103039]