May 2026 (30)
ABB B&R Automation Runtime Denial-of-Service Vulnerability
2 rules 1 TTP 1 CVEA denial-of-service vulnerability (CVE-2025-11044) exists in ABB B&R Automation Runtime versions prior to 6.5 and R4.93, where an unauthenticated attacker can exploit a race condition to cause permanent denial-of-service.
ABB B&R Automation Studio Improper Certificate Validation Vulnerability
2 rules 2 TTPs 1 CVEABB B&R Automation Studio versions before 6.5 are vulnerable to improper certificate validation (CVE-2025-11043), potentially allowing an unauthenticated attacker to intercept and interfere with data exchanges, necessitating patching and secure network configurations.
Johnson Controls CEM AC2000 Privilege Escalation via DLL Hijacking
2 rules 1 TTPA vulnerability exists in Johnson Controls CEM AC2000 versions 12.0, 11.0, and 10.6 due to an uncontrolled search path element that could allow a standard user to escalate privileges on the host machine via DLL hijacking.
Weaver E-cology Unauthenticated RCE Exploitation
2 rules 2 TTPs 1 CVEA critical unauthenticated remote code execution vulnerability (CVE-2026-22679) in Weaver E-cology office automation software is being actively exploited to execute system commands and reconnaissance activities on affected servers.
OpenCTI Vulnerability Allows Privilege Escalation to Administrator
2 rules 1 TTPA remote, authenticated attacker can exploit a vulnerability in OpenCTI to gain administrator privileges, potentially leading to unauthorized access and control over the platform.
Dell Computer Vulnerability Allows Local Code Execution
2 rules 1 TTPA local attacker can exploit a vulnerability in Dell computers to execute arbitrary code.
BusyBox Vulnerability Allows Remote Code Execution or Denial-of-Service
2 rules 2 TTPsA vulnerability in BusyBox allows a remote attacker on an adjacent network to execute arbitrary code or cause a denial-of-service condition.
CloudZ RAT Abuses Microsoft Phone Link to Steal SMS and OTPs
2 rules 1 TTPA new version of the CloudZ RAT utilizes the Pheno plugin to hijack Microsoft Phone Link connections, enabling the theft of SMS messages and one-time passwords (OTPs) from victims' mobile devices.
CloudZ RAT Abusing Windows Phone Link to Steal OTPs
2 rules 6 TTPsAn unknown attacker is using the CloudZ RAT and its Pheno plugin to hijack the Microsoft Phone Link application and intercept SMS and OTP messages from connected mobile devices, active since at least January 2026.
Potential Protocol Tunneling via Cloudflared
2 rules 2 TTPs 1 IOCAdversaries may abuse Cloudflare Tunnel (cloudflared) on Windows systems to proxy command and control traffic or exfiltrate data through Cloudflare's edge, evading direct connection blocking.
NetBox Vulnerability Allows Remote Code Execution
2 rules 1 TTPA remote, authenticated attacker can exploit a vulnerability in NetBox to execute arbitrary program code.
Multiple Vulnerabilities in Apache HTTP Server
2 rules 6 TTPsMultiple vulnerabilities in Apache HTTP Server can be exploited by an attacker to gain elevated privileges, execute arbitrary code, bypass security measures, disclose sensitive information, or cause a denial-of-service condition.
Red Hat Enterprise Linux freeipmi Vulnerability Allows Code Execution
2 rules 4 TTPsA remote, anonymous attacker can exploit a vulnerability in Red Hat Enterprise Linux freeipmi to cause a denial of service condition or memory corruption, potentially allowing arbitrary code execution.
ScarCruft (APT37) Deploying BirdCall Android Backdoor via Compromised Game Platform
2 rules 5 TTPs 1 IOCThe APT37 group (ScarCruft) is distributing an Android version of the BirdCall backdoor via a supply-chain attack targeting a Chinese video game platform, sqgame[.]net, to collect sensitive information from users.
Red Hat Enterprise Linux Vulnerability Allows Privilege Escalation and Code Execution
2 rules 2 TTPsA remote, anonymous attacker can exploit a vulnerability in Red Hat Enterprise Linux (python-wheel) to escalate privileges or execute arbitrary code.
Multiple Vulnerabilities in vm2 Sandbox
2 rules 3 TTPsMultiple vulnerabilities in vm2 allow attackers to execute arbitrary code, perform denial of service, disclose information, and bypass security measures.
Multiple Vulnerabilities in Prometheus Allow for DoS, Information Disclosure, and XSS
2 rules 2 TTPsMultiple vulnerabilities in Prometheus could allow an attacker to perform a Denial of Service attack, disclose sensitive information, or execute Cross-Site Scripting attacks.
Microsoft Product Vulnerability CVE-2026-37457
2 rules 1 CVECVE-2026-37457 is a vulnerability affecting a Microsoft product, for which details are currently unavailable.
Forminator Forms Plugin Path Traversal Vulnerability
2 rules 1 TTP 1 CVEThe Forminator Forms WordPress plugin is vulnerable to an unauthenticated path traversal that allows reading arbitrary files on the server when specific features are enabled.
54yyyu code-mcp Command Injection Vulnerability (CVE-2026-7812)
2 rules 1 TTP 1 CVEA command injection vulnerability (CVE-2026-7812) exists in the git_operation function of 54yyyu code-mcp's MCP Tool, allowing remote attackers to execute arbitrary commands by manipulating the operation argument.
Path Traversal Vulnerability in UsamaK98 python-notebook-mcp
3 rules 1 TTP 1 CVEA path traversal vulnerability exists in the create_notebook/read_notebook/edit_cell/add_cell functions of server.py in UsamaK98's python-notebook-mcp, allowing remote attackers to access arbitrary files.
AWP Classifieds WordPress Plugin SQL Injection Vulnerability
2 rules 1 TTP 1 CVEThe AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the 'regions' parameter array keys in versions up to, and including, 4.4.5, potentially allowing unauthenticated attackers to extract sensitive information from the database.
WordPress Mentoring Plugin Privilege Escalation Vulnerability
2 rules 1 TTP 1 CVEThe Mentoring plugin for WordPress is vulnerable to privilege escalation, allowing unauthenticated attackers to register with administrator-level user accounts due to improper role restriction in the mentoring_process_registration() function.
Axle-Bucamp MCP-Docusaurus Path Traversal Vulnerability
2 rules 1 TTP 1 CVEA path traversal vulnerability exists in Axle-Bucamp MCP-Docusaurus versions up to commit 404bc028e15ec304c9a045528560f4b5f27a17e0, allowing remote attackers to access sensitive files by manipulating the DOCS_DIR/path argument in specific functions.
A-G-U-P-T-A wireshark-mcp OS Command Injection Vulnerability
2 rules 1 TTP 1 CVEA-G-U-P-T-A wireshark-mcp is vulnerable to remote OS command injection (CVE-2026-7785) via manipulation of the `quick_capture` function in `pyshark_mcp.py`, potentially allowing attackers to execute arbitrary commands on the system.
RTGS2017 NagaAgent Path Traversal Vulnerability
2 rules 2 TTPs 1 CVERTGS2017 NagaAgent up to version 5.1.0 is vulnerable to path traversal via manipulation of the 'Name' argument in the Skills Endpoint, potentially leading to unauthorized file access.
Google Android Remote Code Execution Vulnerability
2 rules 1 TTP 1 CVEA vulnerability in Google Android allows a remote attacker to execute arbitrary code, affecting versions prior to 14, 15, 16 and 16-qpr2 before the May 4, 2026 patch.
Multiple Vulnerabilities in Apache HTTP Server Allow Remote Code Execution, Privilege Escalation, and Denial of Service
3 rules 3 TTPs 5 CVEsMultiple vulnerabilities in Apache HTTP Server versions prior to 2.4.67 can allow remote attackers to execute arbitrary code, escalate privileges, or cause a denial of service.
Multiple Vulnerabilities in PaperCut Allow Data Confidentiality Breach and Security Policy Bypass
2 rules 2 TTPs 3 CVEsMultiple vulnerabilities in PaperCut Embedded App versions prior to 2.2.0 on Ricoh devices and PaperCut NG/MF versions prior to 25.0.11 allow attackers to compromise data confidentiality and bypass security policies, potentially leading to unauthorized access and control.
Traefik Data Confidentiality Vulnerability
2 rules 1 TTPA vulnerability in Traefik allows an attacker to compromise the confidentiality of data, affecting versions v2.11.x prior to v2.11.44, v3.6.x prior to v3.6.15, and v3.7.0-rc.x prior to v3.7.0-rc.3.