May 2026 (30)
Cisco Enterprise Chat and Email Lite Agent File Upload Vulnerability
2 rules 1 TTPAn authenticated attacker with agent privileges can upload malicious files to Cisco Enterprise Chat and Email (ECE) via the Lite Agent feature, leading to potential browser-based attacks against other users.
ClickFix Campaign Targets macOS Users with Infostealers via Fake Utility Fixes
2 rules 5 TTPs 5 IOCsThe ClickFix campaign targets macOS users with fake utility fixes, tricking them into running malicious Terminal commands to install infostealing malware such as Macsync, Shub Stealer, and AMOS.
Grav CMS Privilege De-escalation via User Overwrite
2 rules 2 TTPs 1 IOCA low-privileged user with user creation permissions in Grav CMS can overwrite existing accounts, including the primary administrator, leading to a Denial of Service (DoS) and privilege de-escalation by exploiting a business logic vulnerability in versions prior to 2.0.0-beta.2.
Grav CMS Stored XSS Vulnerability Leading to Potential RCE
2 rules 2 TTPsA stored XSS vulnerability exists in Grav Core + Admin Plugin versions before 2.0.0-beta.2, where a low-privileged user can inject malicious code via a crafted tag, potentially leading to the exfiltration of admin session context, bypassing CSRF protections, and escalating to remote code execution (RCE).
Broadcom Patches Vulnerabilities in Tanzu GemFire Management Console
2 rules 1 TTPBroadcom released a security advisory addressing vulnerabilities in Tanzu GemFire Management Console versions prior to 1.4.4, prompting users to apply necessary updates to mitigate potential risks.
@evomap/evolver Path Traversal Vulnerability Leads to RCE
2 rules 2 TTPsA path traversal vulnerability in `@evomap/evolver` allows a malicious A2A Hub to overwrite project files, leading to remote code execution when a user fetches a malicious skill.
ABB B&R PVI Sensitive Information Logging Vulnerability
2 rules 1 CVEAn authenticated local attacker can gather credential information from ABB B&R PVI client application logs when logging is enabled, addressed in version 6.5.0 (CVE-2026-0936).
awslabs/tough Delegated Roles Signature Threshold Bypass
2 rules 1 TTP 1 IOCAn improper verification of cryptographic signature uniqueness vulnerability in awslabs/tough before v0.22.0 allows remote authenticated users to bypass TUF signature threshold requirements by duplicating a valid signature, leading to the acceptance of forged delegated role metadata.
CISA ICS Advisories Addressing ABB and NSA Products
2 rulesCISA published ICS advisories addressing vulnerabilities in multiple ABB products including AWIN Gateways, Ability OPTIMAX, Symphony Plus Engineering, Edgenius Management Portal, PCM600, System 800xA, Symphony Plus IEC 61850, and NSA GRASSMARLIN, prompting users to apply mitigations and updates.
Dell Security Advisories Address Multiple Vulnerabilities
2 rulesDell published security advisories addressing vulnerabilities in APEX Cloud Platform, Automation Platform, Command | Monitor, CyberSense, NativeEdge Orchestrator, SmartFabric Manager, iDRAC, Disk Library, and PowerProtect Cyber Recovery, requiring users to apply necessary updates.
DevGuard Unauthenticated Identity Assertion via X-Admin-Token
1 rule 2 TTPsDevGuard versions before 1.2.2 are vulnerable to unauthenticated identity assertion via a client-supplied `X-Admin-Token` HTTP request header, potentially granting attackers full control over organizations if they can guess an admin/owner's Kratos identity UUID.
Grav CMS FormFlash Unauthenticated Path Traversal and Arbitrary File Write
2 rules 2 TTPsGrav CMS is vulnerable to an unauthenticated path traversal vulnerability within the FormFlash component, allowing attackers to create arbitrary directories and write files, leading to configuration injection and potential denial of service; fixed in version 2.0.0-beta.2.
Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability Added to CISA KEV Catalog
3 rules 1 TTPCVE-2026-0300, a Palo Alto Networks PAN-OS out-of-bounds write vulnerability, has been added to CISA's Known Exploited Vulnerabilities Catalog due to evidence of active exploitation.
Plug.Cowboy HTTP/2 Atom Table Exhaustion DoS
2 rules 1 TTP 1 CVEAn unauthenticated remote denial-of-service vulnerability in Plug.Cowboy allows attackers to exhaust the BEAM atom table via HTTP/2 requests, crashing the Erlang VM.
Prometheus Azure AD Remote Write OAuth Client Secret Exposure
2 rules 1 TTP 1 CVEThe client_secret field in Prometheus' Azure AD remote write OAuth configuration was exposed in plaintext via the `/-/config` HTTP API endpoint, due to being incorrectly typed as a string, potentially allowing unauthorized access to sensitive credentials.
PyLoad Path Traversal Vulnerability in set_package_data
2 rules 1 TTPPyLoad versions 0.5.0b3.dev99 and earlier are vulnerable to a path traversal vulnerability in the `set_package_data` function, allowing attackers to write files to arbitrary directories with the privileges of the PyLoad process.
ScarCruft Compromises Gaming Platform in Supply-Chain Attack
2 rules 4 TTPs 4 IOCsThe ScarCruft APT group conducted a supply-chain attack targeting the Yanbian region by compromising a gaming platform, sqgame, used by ethnic Koreans, trojanizing Windows and Android games with the BirdCall backdoor for espionage activities since late 2024.
Sophisticated AitM Phishing Campaign Targeting US Organizations
2 rules 2 TTPsA sophisticated phishing campaign targeting US organizations uses a 'code of conduct review' theme to lure victims to a malicious website, employing adversary-in-the-middle (AitM) techniques to capture authentication tokens and gain account access.
ssrfcheck vulnerable to SSRF via IPv4-mapped IPv6 bypass
2 rules 1 TTPssrfcheck version 1.3.0 and earlier is vulnerable to server-side request forgery (SSRF) attacks because it fails to block private IP addresses encoded as IPv4-mapped IPv6 addresses due to WHATWG URL parsing.
VM2 Sandbox Breakout via Inspect Function Allows Remote Code Execution
2 rules 1 TTP 1 CVEA sandbox breakout vulnerability exists in VM2 through the `inspect` function, allowing attackers to escape the sandbox and execute arbitrary commands on the host system.
VM2 Sandbox Escape via Promise Species Manipulation
2 rules 2 TTPs 1 CVEA vulnerability in vm2 versions 3.10.3 and earlier allows attackers to bypass a previous sandbox escape fix by manipulating Promise species, leading to arbitrary code execution on the host system.
Vulnerabilities in Unitree Embodied AI Systems
3 rules 7 TTPs 1 CVE 1 IOCCommercially available Unitree robots are susceptible to multiple vulnerabilities, including hardcoded keys and command injection, allowing attackers to gain root-level access, exfiltrate data, and potentially create physical botnets.
webonyx/graphql-php Unbounded Recursion Vulnerability
2 rules 1 TTPThe webonyx/graphql-php library has an unbounded recursion vulnerability in its parser that can lead to a stack overflow, causing a denial of service by terminating the PHP process with a SIGSEGV.
WPS Office Exploitation via DLL Hijack
2 rules 2 TTPs 2 CVEsThe rule detects the loading of a remote library by the WPS Office promecefpluginhost.exe executable, which may indicate exploitation of CVE-2024-7262 or CVE-2024-7263 via DLL hijacking abusing the ksoqing custom protocol handler.
Argo CD Information Disclosure Vulnerability
2 rules 2 TTPsA remote, authenticated attacker can exploit a vulnerability in Argo CD to disclose sensitive information.
Multiple Vulnerabilities in Apache Wicket
2 rules 2 TTPsMultiple vulnerabilities in Apache Wicket could allow an attacker to bypass security measures, perform Cross-Site Scripting (XSS) attacks, disclose confidential information, or manipulate data.
Asterisk pjproject Multiple Vulnerabilities
2 rules 4 TTPsA remote, authenticated attacker can exploit multiple vulnerabilities in Asterisk's pjproject to cause denial-of-service or memory corruption, potentially leading to code execution or security bypass.
Multiple Vulnerabilities in Snipe-IT Allow for Code Execution and Privilege Escalation
2 rules 2 TTPsMultiple vulnerabilities in Snipe-IT could allow an attacker to perform cross-site scripting attacks, redirect users to malicious websites, gain administrator rights, or execute arbitrary code.
MinIO Information Disclosure Vulnerability
2 rules 1 TTPA remote, authenticated attacker can exploit a vulnerability in MinIO to disclose sensitive information.
Multiple Vulnerabilities in Rapid7 Velociraptor
2 rules 2 TTPsMultiple vulnerabilities in Rapid7 Velociraptor could allow an attacker to perform a denial-of-service attack or disclose sensitive information.