CraftedSignal · Threat Feed
Threat intelligence feed for SOC and IR teams
MITRE ATT&CK coverage, CVE references, and rule metadata from the CraftedSignal threat-intelligence pipeline. Detection rules and IOCs stay inside the platform; this feed is the public face of what we ship.
Latest briefs
View all →Gotenberg ExifTool Tag Blocklist Bypass via Group-Prefixed Tag Names
2 rules 1 TTPGotenberg is vulnerable to an ExifTool tag blocklist bypass, allowing unauthenticated attackers to rename, move, and modify permissions of files within the container by using group-prefixed tag names like 'System:FileName' or the 'FilePermissions' tag in HTTP requests.
Contact Form 7 WordPress Plugin Uncontrolled Resource Consumption Vulnerability
2 rules 1 TTP 1 CVEThe Contact Form 7 WordPress plugin through version 2.6.7 is vulnerable to uncontrolled resource consumption, allowing unauthenticated attackers to exhaust server memory and crash the PHP process by supplying an arbitrarily large integer value to the REST API endpoint, leading to unbounded loop execution.
Arelle Unauthenticated Remote Code Execution Vulnerability
2 rules 1 TTP 1 CVEArelle before 2.39.10 is vulnerable to unauthenticated remote code execution via the /rest/configure REST endpoint, allowing attackers to execute arbitrary Python code by supplying a malicious URL through the plugins parameter.
WordPress Easy PayPal Events & Tickets Plugin Information Disclosure Vulnerability
2 rules 1 TTP 1 CVEAn information disclosure vulnerability in the Easy PayPal Events & Tickets WordPress plugin (versions 1.3 and earlier) allows unauthenticated attackers to enumerate and retrieve all customer order records via the scan_qr.php endpoint.
WordPress Easy PayPal Events & Tickets Plugin Authentication Bypass Vulnerability
2 rules 1 TTP 1 CVE 1 IOCAn unauthenticated remote attacker can exploit a hardcoded authentication bypass vulnerability in the Easy PayPal Events & Tickets plugin for WordPress (versions 1.3 and earlier) by providing 'test' as the hash parameter, allowing retrieval of sensitive order details.
BusyBox DHCPv6 Client Heap Buffer Overflow Vulnerability (CVE-2026-29004)
2 rules 2 TTPs 1 CVEA heap buffer overflow vulnerability in BusyBox's DHCPv6 client allows network-adjacent attackers to trigger memory corruption, denial of service, or arbitrary code execution via crafted DHCPv6 responses.
OpenMRS Module Upload Path Traversal Vulnerability
2 rules 1 TTPOpenMRS versions 2.7.8 and earlier, as well as versions 2.8.0 through 2.8.5, are vulnerable to a path traversal (Zip Slip) attack via the `POST /openmrs/ws/rest/v1/module` endpoint that allows authenticated attackers to achieve arbitrary file write and remote code execution.
Quarkus Vertx HTTP Authorization Bypass via Matrix Parameters
2 rules 2 TTPsQuarkus Vertx HTTP versions < 3.20.6.1, >= 3.21.0 and < 3.27.3.1, >= 3.30.0 and < 3.33.1.1, and >= 3.34.0 and < 3.35.1.1 are vulnerable to an authorization bypass where appending a semicolon and arbitrary text to the request URL allows unauthorized access to protected resources.
NetBox RCE via Jinja2 Template Injection (CVE-2026-29514)
2 rules 1 TTP 1 CVENetBox versions 4.3.5 through 4.5.4 are vulnerable to remote code execution (RCE) via template injection, where authenticated users with specific permissions can inject malicious Python callables into template parameters, bypassing Jinja2 sandboxing to execute arbitrary code.
Qualcomm PLC FW Buffer Overflow via Incorrect Authorization (CVE-2026-25293)
2 rules 2 TTPs 1 CVECVE-2026-25293 is a critical buffer overflow vulnerability in Qualcomm PLC FW due to incorrect authorization, potentially allowing unauthorized access and control over programmable logic controllers.
Memory Corruption Vulnerability in Digital Signal Processor (CVE-2025-47407)
2 rules 1 TTP 1 CVECVE-2025-47407 describes a memory corruption vulnerability affecting the digital signal processor due to allocation failure at the kernel level, potentially leading to arbitrary code execution with elevated privileges on affected systems.
Qualcomm Driver IOCTL Memory Corruption Vulnerability
2 rules 1 TTP 1 CVEA memory corruption vulnerability, CVE-2025-47408, exists in Qualcomm drivers when another driver calls an IOCTL with an invalid input/output buffer, potentially leading to code execution or denial of service.