May 2026 (30)
Dalfox Unauthenticated Remote DoS via Closed-Channel Write in ParameterAnalysis
2 rules 1 TTPDalfox is vulnerable to an unauthenticated remote denial-of-service (DoS) vulnerability (CVE-2026-45090) due to a closed channel write in the `ParameterAnalysis` function, triggered by a crafted POST request that crashes the Dalfox server process.
Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`
2 rules 1 TTPDalfox in REST API server mode is vulnerable to unauthenticated remote code execution (CVE-2026-45087) because the server binds to 0.0.0.0:6664 by default without requiring an API key and deserializes attacker-supplied JSON in `POST /scan` without stripping the `FoundAction` and `FoundActionShell` fields, allowing arbitrary command execution.
sealed-env Enterprise Mode TOTP Secret Leak in Unseal Tokens (CVE-2026-45091)
2 rules 1 TTP 1 CVEsealed-env versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token, allowing an attacker with a leaked token and the master key to mint new unseal tokens indefinitely.
protobuf.js Code Injection via Crafted Bytes Field Defaults (CVE-2026-44293)
2 rules 1 TTPprotobuf.js is vulnerable to code injection (CVE-2026-44293); by crafting a protobuf descriptor with a non-string default value for a `bytes` field, an attacker can inject arbitrary Javascript code into the generated `toObject` conversion function if default values are enabled, requiring the application to load an attacker-controlled schema and convert a message of the affected type with defaults enabled.
protobuf.js Denial-of-Service Vulnerability via Unbounded Recursion (CVE-2026-44289)
2 rules 1 TTPprotobuf.js is vulnerable to a denial-of-service (DoS) attack (CVE-2026-44289) due to unbounded recursion while decoding nested protobuf data, potentially leading to stack exhaustion and process crashes when processing crafted protobuf binary payloads.
protobuf.js Prototype Pollution Leads to Code Generation Gadget
2 rulesprotobufjs versions 7.5.5 and earlier, as well as versions 8.0.0 through 8.0.1, are vulnerable to arbitrary JavaScript execution if Object.prototype has been polluted, allowing attackers to influence generated encode/decode functions.
protobuf.js CLI pbts Command Injection Vulnerability
2 rules 1 TTPThe protobuf.js CLI tool `pbts` is vulnerable to OS command injection via crafted filenames or paths with shell metacharacters, potentially leading to arbitrary command execution with the privileges of the `pbts` process when invoked on attacker-influenced file paths; CVE-2026-42290.
Schneider Electric Security Advisory AV26-449 Addressing Multiple Vulnerabilities
2 rulesSchneider Electric published advisories on May 12, 2026, addressing vulnerabilities in multiple products including Ecostruxure Machine Expert HVAC, Easergy MiCOM C264, Easergy C5, Easergy MiCOM P30, Easergy MiCOM P40, EcoStruxure Power Automation System, iPMFLS, PowerLogic, Saitel DP, EasyLogic T150, EasyLogic T150 Remote Terminal Unit and Controller, Saitel DP Remote Terminal Unit and Controller, EcoStruxure Panel Server PAS400, PAS600, PAS600V2, PAS800, PAS800V2 and Easergy MiCOM Px40 Series related to clear text storage, insufficient entropy, improper path restrictions and insecure defaults.
Siemens Security Advisory Addressing Multiple Product Vulnerabilities
2 rulesSiemens released a security advisory on May 12, 2026, addressing vulnerabilities in a range of products including RUGGEDCOM, SCALANCE, Solid Edge, and SIMATIC, prompting users to apply necessary updates.
Multiple Vulnerabilities in Microsoft Azure
2 rules 3 CVEsMultiple vulnerabilities exist in Microsoft Azure, specifically affecting azl3 kernel and azl3 krb5, potentially leading to an unspecified security issue.
Multiple Vulnerabilities in Microsoft Edge Allow for Privilege Escalation, Data Breach, and Security Policy Bypass
2 rules 1 TTP 1 CVEMultiple vulnerabilities in Microsoft Edge and Microsoft Edge for Android can allow an attacker to perform privilege escalation, cause a data breach, and bypass security policies.
Multiple Vulnerabilities in Centreon Products
2 rules 1 TTP 1 IOCMultiple vulnerabilities in Centreon products allow for remote code execution, SQL injection, and cross-site scripting.
Multiple Vulnerabilities in Schneider Electric Products
2 rules 2 CVEsMultiple vulnerabilities in Schneider Electric products can allow an attacker to perform privilege escalation, data confidentiality breaches, and data integrity breaches.
Multiple Vulnerabilities in Apple Products Allow for Arbitrary Code Execution, Privilege Escalation, and Data Confidentiality Compromise
2 rules 3 TTPs 5 CVEsMultiple vulnerabilities in Apple products could allow an attacker to execute arbitrary code, escalate privileges, and compromise data confidentiality.
Multiple Vulnerabilities in Axis Products Allow Remote Code Execution and Privilege Escalation
2 rules 2 TTPs 4 CVEsMultiple vulnerabilities in Axis products allow remote arbitrary code execution and privilege escalation in Axis OS versions 12.10.x prior to 12.10.37 and 12.9.x prior to 12.9.33 for Active Track.
CPython Security Policy Bypass Vulnerability
2 rules 1 TTP 1 CVEA vulnerability in CPython, tracked as CVE-2026-7210, allows an attacker to bypass the security policy, requiring the latest security patch for mitigation.
LibreNMS Multiple XSS Vulnerabilities
2 rules 1 TTPMultiple reflected cross-site scripting (XSS) vulnerabilities exist in LibreNMS versions 25.12.0 to before 26.3.0, allowing an attacker to inject malicious code into a user's browser session.
Traefik Security Policy Bypass Vulnerability
1 rule 1 TTPA security policy bypass vulnerability exists in Traefik versions prior to v2.11.46, v3.6.x before v3.6.17, and v3.7.x before v3.7.1, allowing attackers to potentially circumvent intended access controls.
OPNsense Multiple Vulnerabilities Lead to Remote Code Execution
2 rules 2 TTPsA remote, authenticated attacker can exploit multiple vulnerabilities in OPNsense to execute arbitrary code with administrator privileges.
Siemens SIMATIC S7 PLCs Web Server Vulnerabilities Allow Cross-Site Scripting
2 rules 1 TTPA remote, authenticated attacker can exploit multiple vulnerabilities in Siemens SIMATIC S7 PLCs Web Server to perform cross-site scripting attacks, potentially leading to information disclosure or further unauthorized actions.
Siemens SIPROTEC 5 Information Disclosure Vulnerability
2 rules 1 TTPA remote, anonymous attacker can exploit a vulnerability in Siemens SIPROTEC 5 devices to disclose sensitive information.
Shai-Hulud Malware Used in Supply Chain Attack via Compromised npm Packages
3 rules 7 TTPs 3 IOCsThe Shai-Hulud malware was used in a large-scale software supply-chain attack compromising hundreds of packages across open-source software ecosystems by compromising developer secrets and CI/CD pipelines.
Siemens Teamcenter Hardcoded Key Vulnerability (CVE-2026-33893)
2 rules 2 TTPs 1 CVECVE-2026-33893 describes a vulnerability in Siemens Teamcenter where hardcoded keys used for obfuscation are stored directly within the application, potentially allowing an attacker to obtain these keys and gain unauthorized access.
Multiple Vulnerabilities in dnsmasq
2 rules 9 TTPsMultiple vulnerabilities in dnsmasq could allow an attacker to cause a denial of service, execute arbitrary code with root privileges, disclose sensitive information, manipulate data, and redirect users to malicious domains.
CVE-2026-6001: ABIS Technology BAPSİS Authorization Bypass Vulnerability
1 rule 1 TTP 1 CVECVE-2026-6001 is an authorization bypass vulnerability in ABIS Technology Ltd. Co. BAPSİS before version 202604152042, allowing exploitation of trusted identifiers through a user-controlled key.
Solid Edge SE2026 Stack-Based Overflow Vulnerability (CVE-2026-44412)
2 rules 1 TTP 1 CVEA stack-based overflow vulnerability in Solid Edge SE2026 (versions prior to V226.0 Update 5) allows for arbitrary code execution via specially crafted PAR files.
Solid Edge SE2026 Uninitialized Pointer Access Vulnerability (CVE-2026-44411)
2 rules 2 TTPs 1 CVESolid Edge SE2026 is vulnerable to uninitialized pointer access while parsing specially crafted PAR files, potentially leading to arbitrary code execution in the context of the current process (CVE-2026-44411).
CVE-2026-25789 - Firmware Update Page Filename Sanitization Vulnerability
2 rules 2 TTPs 1 CVECVE-2026-25789 describes a vulnerability where affected devices do not properly validate and sanitize filenames on the Firmware Update page, potentially allowing a remote attacker to execute malicious JavaScript in the context of the user's session through social engineering, leading to session hijacking or credential theft.
CVE-2026-22925: Siemens SIMATIC CN 4100 Resource Exhaustion via TCP SYN Flood
1 rule 1 CVESiemens SIMATIC CN 4100 versions before V5.0 are vulnerable to resource exhaustion due to processing a high volume of TCP SYN packets, leading to a denial-of-service condition.
Siemens RUGGEDCOM ROX Devices Vulnerable to Remote Code Execution via Feature Key Injection (CVE-2025-40947)
2 rules 1 TTP 1 CVECVE-2025-40947 describes a vulnerability in Siemens RUGGEDCOM ROX devices that allows authenticated remote attackers to inject arbitrary commands via a maliciously crafted feature key, resulting in remote code execution with root privileges.