May 2026 (30)
Persistence via WMI Standard Registry Provider
3 rules 1 TTPThe rule identifies the use of Windows Management Instrumentation StdRegProv (registry provider) to modify commonly abused registry locations for persistence by detecting registry changes made by WmiPrvSe.exe in specific registry paths.
CVE-2026-40410 - Windows SMB Client Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-40410 is a use-after-free vulnerability in the Windows SMB Client that allows an authorized attacker to elevate privileges locally.
Intel Addresses Vulnerabilities in Multiple Software Products
3 rulesIntel released security advisories addressing vulnerabilities in Display Virtualization for Windows OS driver software, Intel EMA software, AI Playground software, and Intel Vision software, requiring users to update to the latest versions.
CVE-2026-42899 - ASP.NET Core Infinite Loop Denial of Service
2 rules 1 TTP 1 CVECVE-2026-42899 describes an infinite loop vulnerability in ASP.NET Core that allows an unauthorized attacker to perform a denial of service attack over a network.
CVE-2026-42896 - Windows DWM Core Library Integer Overflow Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-42896 describes an integer overflow vulnerability in the Windows DWM Core Library, allowing an authorized local attacker to elevate privileges.
CVE-2026-42893: M365 Copilot Command Injection Vulnerability
1 rule 1 TTP 1 CVECVE-2026-42893 is a command injection vulnerability in M365 Copilot that allows an unauthorized attacker to perform tampering over a network.
CVE-2026-42832 - Microsoft Office Improper Access Control Vulnerability Leading to Spoofing
2 rules 2 TTPs 1 CVECVE-2026-42832 is an improper access control vulnerability in Microsoft Office that allows an unauthorized attacker to perform local spoofing.
CVE-2026-42831 Heap-based Buffer Overflow in Microsoft Office
1 rule 1 TTP 1 CVECVE-2026-42831 is a heap-based buffer overflow vulnerability in Microsoft Office, allowing a local attacker to execute arbitrary code with a CVSS score of 7.8.
CVE-2026-42825: Use-After-Free in Windows Telephony Service
2 rules 1 TTP 1 CVECVE-2026-42825 is a use-after-free vulnerability in the Windows Telephony Service that allows an authorized, local attacker to elevate privileges.
CVE-2026-41613 - Visual Studio Code Session Fixation Vulnerability
2 rules 1 TTP 1 CVECVE-2026-41613 is a session fixation vulnerability in Visual Studio Code that allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-41611: Visual Studio Code XSS Vulnerability
2 rules 4 TTPs 1 CVECVE-2026-41611 is a cross-site scripting (XSS) vulnerability in Visual Studio Code that allows an attacker to execute code locally due to improper neutralization of script-related HTML tags.
CVE-2026-41109: Improper Neutralization of Special Elements in GitHub Copilot and Visual Studio
2 rules 1 TTP 1 CVECVE-2026-41109 describes an improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in GitHub Copilot and Visual Studio, allowing an unauthorized attacker to bypass a security feature over a network.
CVE-2026-41102: Microsoft PowerPoint Improper Access Control Vulnerability Leading to Local Spoofing
2 rules 1 TTP 1 CVECVE-2026-41102 is an improper access control vulnerability in Microsoft Office PowerPoint that allows an authorized attacker to perform spoofing locally.
CVE-2026-41101: Microsoft Office Word Improper Access Control Vulnerability Leading to Local Spoofing
2 rules 1 TTP 1 CVECVE-2026-41101 is a vulnerability in Microsoft Office Word due to improper access control, which allows an authorized attacker to perform spoofing locally, with a CVSS v3.1 base score of 7.1.
CVE-2026-41095: Use-After-Free in Data Deduplication Leads to Local Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-41095 is a use-after-free vulnerability in the Data Deduplication component of Windows that allows an authenticated attacker to elevate privileges locally.
CVE-2026-41094: Microsoft Data Formulator Code Injection Vulnerability
2 rules 1 TTP 1 CVECVE-2026-41094 is a code injection vulnerability in Microsoft Data Formulator, allowing an unauthorized attacker to execute arbitrary code over a network.
CVE-2026-41088: Windows Ancillary Function Driver for WinSock Local Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-41088 is a vulnerability in Windows Ancillary Function Driver for WinSock that allows an authorized attacker to elevate privileges locally due to external control of file name or path.
CVE-2026-41086: Windows Admin Center Privilege Escalation via Improper Access Control
2 rules 1 TTP 1 CVECVE-2026-41086 describes an improper access control vulnerability in Windows Admin Center, allowing an authorized attacker to elevate privileges over a network.
CVE-2026-40420 - Microsoft Office Click-To-Run Improper Access Control Vulnerability
2 rules 1 TTP 1 CVECVE-2026-40420 is an improper access control vulnerability in Microsoft Office Click-To-Run allowing an authorized attacker to elevate privileges locally.
CVE-2026-40419: Microsoft Office Use-After-Free Vulnerability for Local Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-40419 is a use-after-free vulnerability in Microsoft Office that allows an authenticated, local attacker to elevate privileges.
CVE-2026-40418: Microsoft Office Click-To-Run Use-After-Free Vulnerability
2 rules 1 TTP 1 CVECVE-2026-40418 is a use-after-free vulnerability in Microsoft Office Click-To-Run that allows an authorized attacker to elevate privileges locally.
CVE-2026-40415 Use-After-Free Vulnerability in Windows TCP/IP
2 rules 1 TTP 1 CVECVE-2026-40415 is a use-after-free vulnerability in Windows TCP/IP that allows an unauthorized attacker to execute code over a network.
CVE-2026-40414: Windows TCP/IP Null Pointer Dereference Denial-of-Service
2 rules 3 TTPs 1 CVEA null pointer dereference vulnerability exists in Windows TCP/IP, allowing an unauthorized attacker on an adjacent network to cause a denial-of-service condition.
CVE-2026-40413: Windows TCP/IP Null Pointer Dereference Denial of Service
2 rules 1 TTP 1 CVECVE-2026-40413 is a null pointer dereference vulnerability in Windows TCP/IP that allows an unauthenticated attacker on an adjacent network to cause a denial-of-service condition.
CVE-2026-40408 - Windows Kernel-Mode Drivers Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-40408 is a use-after-free vulnerability in Windows Kernel-Mode Drivers, enabling a locally authenticated attacker to elevate privileges.
CVE-2026-40407 - Windows CLFS Driver Heap Overflow for Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-40407 is a heap-based buffer overflow vulnerability in the Windows Common Log File System (CLFS) Driver, enabling a locally authenticated attacker to escalate privileges on the system.
CVE-2026-40406 - Windows TCP/IP Use-After-Free Information Disclosure
2 rules 1 TTP 1 CVECVE-2026-40406 is a use-after-free vulnerability in Windows TCP/IP that allows an unauthorized attacker to disclose sensitive information over a network.
CVE-2026-40405 - Windows TCP/IP Null Pointer Dereference DoS
2 rules 1 TTP 1 CVECVE-2026-40405 describes a null pointer dereference vulnerability in Windows TCP/IP, allowing an unauthenticated attacker to cause a denial of service over a network.
CVE-2026-40403 Heap-based Buffer Overflow in Windows Win32K - GRFX
2 rules 2 TTPsCVE-2026-40403 is a heap-based buffer overflow vulnerability in Windows Win32K - GRFX that allows an authorized local attacker to execute arbitrary code, potentially leading to privilege escalation and code execution.
CVE-2026-40401 - Windows TCP/IP Null Pointer Dereference Denial of Service
2 rules 1 TTP 1 CVECVE-2026-40401 is a null pointer dereference vulnerability in Windows TCP/IP that allows a local, unauthorized attacker to cause a denial of service.