May 2026 (30)
Plug Multipart Header Parsing Denial-of-Service Vulnerability (CVE-2026-8468)
2 rules 1 TTP 1 CVEPlug versions 1.4.0 to 1.19.1 are vulnerable to denial-of-service (CVE-2026-8468) due to unbounded buffer accumulation in multipart header parsing, allowing an unauthenticated attacker to exhaust server memory by sending a crafted multipart/form-data request.
Compromised @cap-js Packages Lead to Credential Theft and Self-Propagation
2 rules 2 TTPsCompromised versions of `@cap-js/sqlite@2.2.2`, `@cap-js/postgres@2.2.2`, and `@cap-js/db-service@2.10.1` were published, leading to credential harvesting and attempted self-propagation; upgrade immediately and rotate credentials.
FreePBX Security Advisories for Security-Reporting Module Vulnerabilities
2 rules 1 TTPFreePBX released security advisories addressing authenticated SQL injection and local file inclusion vulnerabilities in the Security-Reporting cdr and dashboard modules for FreePBX 16 and 17.
MediaArea MediaInfoLib Channel Splitting Heap-Based Buffer Overflow (CVE-2026-22554)
2 rules 1 TTP 1 CVEMediaArea MediaInfoLib is vulnerable to a heap-based buffer overflow vulnerability when splitting channels, potentially leading to arbitrary code execution.
Multiple Vulnerabilities in Mozilla Products Lead to Potential RCE and Privilege Escalation
2 rules 3 TTPs 4 CVEsMultiple vulnerabilities in Mozilla Firefox ESR, Firefox, Firefox for iOS, and Thunderbird products can lead to arbitrary code execution, privilege escalation, and remote denial of service.
Multiple Vulnerabilities in Suricata Network Threat Detection Engine
2 rules 2 TTPsMultiple vulnerabilities in Suricata versions before 8.0.5 and 7.0.16 could allow a remote attacker to execute arbitrary code or cause a denial-of-service condition.
Multiple Vulnerabilities in Symfony Framework
3 rules 1 TTPMultiple vulnerabilities in Symfony, including CVE-2026-45070, CVE-2026-45077, CVE-2026-45304, CVE-2026-45305, CVE-2026-45753, CVE-2026-45754, CVE-2026-45755, CVE-2026-45756, CVE-2026-46626, and CVE-2026-47212, can lead to remote denial of service, cross-site scripting (XSS), and cross-site request forgery (CSRF) attacks.
Multiple Vulnerabilities in Docker Desktop Allow Remote Code Execution
2 rules 1 TTPMultiple vulnerabilities in Docker Desktop versions prior to 4.71.0 allow a remote attacker to execute arbitrary code.
Wireshark Remote Denial of Service Vulnerability
2 rules 1 TTPA vulnerability in Wireshark versions 4.4.x before 4.4.16 and 4.6.x before 4.6.6 allows a remote attacker to cause a denial of service.
CVE-2026-3039: BIND TKEY Authentication Memory Consumption Vulnerability
2 rules 1 TTP 1 CVEBIND servers configured for TKEY-based authentication using GSS-API tokens are susceptible to excessive memory consumption upon receiving and processing crafted packets, impacting availability.
ISC BIND Use-After-Free Vulnerability Due to Race Condition (CVE-2026-5947)
2 rules 1 CVEA race condition in ISC BIND can lead to a use-after-free vulnerability (CVE-2026-5947) when handling SIG(0) signed DNS messages, potentially leading to undefined behavior.
CVE-2026-5946: BIND 9 `named` Assertion Failure Vulnerability
2 rules 1 CVEMultiple flaws in BIND 9's `named` component, specifically versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1, can be exploited by sending specially crafted DNS requests with non-`IN` CLASS or meta-classes, leading to assertion failures and potential denial-of-service.
CVE-2026-45584 - Microsoft Defender Heap-based Buffer Overflow RCE
2 rules 1 TTP 1 CVECVE-2026-45584 is a heap-based buffer overflow vulnerability in Microsoft Defender that allows an unauthorized attacker to execute arbitrary code over a network.
CVE-2026-3593 Use-After-Free Vulnerability in BIND 9 DNS-over-HTTPS
2 rules 2 TTPs 1 CVEA use-after-free vulnerability in the DNS-over-HTTPS implementation of BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1 could allow an attacker to cause a denial of service or potentially execute arbitrary code.
Rsync TOCTOU Vulnerability Allows File Write Redirection
2 rules 1 TTP 1 CVERsync versions before 3.4.3 are vulnerable to a TOCTOU race condition allowing attackers with write access to a module path to redirect file writes outside intended directories by replacing parent directory components with symbolic links, potentially leading to privilege escalation when the daemon runs with elevated privileges and chroot is disabled.
Squid Vulnerability Allows Remote Code Execution
2 rules 1 TTPA remote, anonymous attacker can exploit a vulnerability in Squid to execute arbitrary program code, leading to potential system compromise.
Squid Vulnerability Allows Security Bypass and Information Disclosure
2 rules 2 TTPsA remote, anonymous attacker can exploit a vulnerability in Squid to bypass security precautions and disclose information, potentially leading to unauthorized access or data leakage.
Multiple Vulnerabilities in Rsync
2 rules 4 TTPsMultiple vulnerabilities in Rsync could be exploited by an attacker to elevate privileges, disclose information, bypass security precautions, and perform a denial of service attack.
Broadcom Automic Automation Agent Unix Privilege Escalation Vulnerability
2 rules 1 TTPA local attacker can exploit a vulnerability in Broadcom Automic Automation Agent Unix to escalate their privileges, potentially gaining unauthorized access to sensitive data and system resources.
Multiple Vulnerabilities in Atlassian Products
2 rules 4 TTPsMultiple vulnerabilities exist in Atlassian products including Bamboo, Bitbucket, Confluence, Crucible, Fisheye, and Jira which could lead to arbitrary code execution, denial of service, information disclosure, cross-site scripting, and security bypass.
Microsoft Azure Portal Windows Admin Center Vulnerability Allows Privilege Escalation
2 rules 1 TTPA local attacker can exploit a vulnerability in Microsoft Azure Portal Windows Admin Center to gain administrator rights, potentially leading to unauthorized access and control over Azure resources.
Multiple Vulnerabilities in Microsoft Defender and Malware Protection Engine
2 rules 3 TTPsMultiple vulnerabilities in Microsoft Defender and Microsoft Malware Protection Engine could allow an attacker to elevate privileges, execute arbitrary code, and cause a denial of service condition.
Multiple Vulnerabilities in Mozilla Firefox and Thunderbird
2 rules 5 TTPsMultiple vulnerabilities in Mozilla Firefox, Firefox ESR, and Thunderbird could allow a remote attacker to execute arbitrary code, disclose information, bypass security restrictions, deceive the user, escalate privileges, or cause a denial-of-service condition.
Vaultwarden Vulnerabilities Allow Privilege Escalation and Information Disclosure
2 rules 3 TTPsMultiple vulnerabilities in Vaultwarden allow a remote, anonymous attacker to gain user privileges and disclose sensitive information.
Multiple Vulnerabilities in Nvidia GPU Display Drivers
2 rules 3 TTPsMultiple vulnerabilities in Nvidia GPU Display Drivers allow a local attacker to escalate privileges, manipulate data, disclose information, cause a denial of service, or execute code.
CVE-2026-9064: 389-ds-base Unauthenticated Remote Denial-of-Service
2 rules 1 TTP 1 CVECVE-2026-9064 describes a denial-of-service vulnerability in 389-ds-base where an unauthenticated attacker can send a crafted LDAP request with excessive controls, causing excessive CPU consumption and heap allocation, leading to latency degradation, worker thread starvation, or out-of-memory termination.
Multiple Vulnerabilities in Mozilla Firefox and Thunderbird
2 rules 2 TTPsMultiple vulnerabilities exist in Mozilla Firefox, Firefox ESR, and Thunderbird that could allow a remote attacker to execute arbitrary code, disclose sensitive information, bypass security measures, or conduct cross-site scripting or spoofing attacks.
AcyMailing WordPress Plugin Missing Authorization Vulnerability (CVE-2026-5200)
2 rules 2 TTPs 1 CVEThe AcyMailing plugin for WordPress is vulnerable to a missing authorization issue (CVE-2026-5200), allowing authenticated attackers with subscriber-level access to modify privileged AcyMailing configuration, export subscriber secret keys, and potentially achieve administrator account takeover if the administrator's email address is known.
CVE-2026-43492 Integer Underflow in mpi_read_raw_from_sgl()
1 rule 1 CVECVE-2026-43492 is an integer underflow vulnerability in the mpi_read_raw_from_sgl function within the lib/crypto component that could lead to unexpected behavior or denial-of-service.
Advanced Database Cleaner Premium WordPress Plugin Vulnerable to Local File Inclusion (CVE-2026-7522)
2 rules 2 TTPs 1 CVEThe Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion (LFI) in versions up to 4.1.0, allowing authenticated attackers with subscriber-level access to include and execute arbitrary PHP files on the server via the 'template' parameter, potentially leading to access control bypass, sensitive data access, or code execution.