windsurf
Security Risk Profile
67
/100
highSecurity Risk Score
Comprehensive risk assessment based on 8 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from July 11, 2025 to present
8
Total CVEs
2
Critical+High
1
Exploited
2
Unpatched
Threat Assessment
Avg CVSS
7.5
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
2
Critical/High
Risk Level
67/100
high
⚠️ 1 Active Exploits⚡ 1 Zero-Days
Severity Distribution
Critical
1High
1Medium
1Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
0Age Distribution
Common Weaknesses (CWE)
1
Command Injection
1
2
Path Traversal
1
Most Affected Products
1. Windsurf Windsurf7
2. Cursor Cursor5
3. OpenVSX OpenVSX2
4. Google Antigravity1
5. Chromium Chromium1
Recent Vulnerabilities
See more →CVE-2026-30615
CVSS 8.0high
4/15/2026🔧 No Patch
https://www.bleepingcomputer.com/news/security/vscode-ide-forks-expose-users-to-recommended-extension-attacks/
unknown
VSCode IDE forks expose users to "recommended extension" attacks
1/5/2026🔧 No Patch
https://www.bleepingcomputer.com/news/security/cursor-windsurf-ides-riddled-with-94-plus-n-day-chromium-vulnerabilities/
unknown
Cursor, Windsurf IDEs riddled with 94+ n-day Chromium vulnerabilities
10/21/2025🔧 No Patch
CVE-2025-62353
CVSS 9.8critical
10/17/2025🔧 No Patch
https://www.bleepingcomputer.com/news/security/malicious-crypto-stealing-vscode-extensions-resurface-on-openvsx/
unknown
Malicious crypto-stealing VSCode extensions resurface on OpenVSX
10/14/2025🔧 No Patch
CVE-2025-36730
CVSS 4.6medium
Windsurf Prompt Injection via Filename
10/14/2025🔧 No Patch
https://www.bleepingcomputer.com/news/security/whitecobra-floods-vscode-market-with-crypto-stealing-extensions/
unknown
'WhiteCobra' floods VSCode market with crypto-stealing extensions
9/13/2025⚠ Exploited🔧 No Patch
https://www.bleepingcomputer.com/news/security/the-zero-day-that-couldve-compromised-every-cursor-and-windsurf-user/
unknown
The zero-day that could've compromised every Cursor and Windsurf user
7/11/2025⚡ Zero-Day🔧 No Patch
Monitor windsurf in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.