May 2026 (30)
Totolink A8000RU Remote Command Injection Vulnerability
2 rules 1 TTP 1 CVEA remote command injection vulnerability exists in the Totolink A8000RU router, specifically in the setAppFilterCfg function, allowing attackers to execute arbitrary commands by manipulating the 'enable' argument.
54yyyu code-mcp Command Injection Vulnerability (CVE-2026-7812)
2 rules 1 TTP 1 CVEA command injection vulnerability (CVE-2026-7812) exists in the git_operation function of 54yyyu code-mcp's MCP Tool, allowing remote attackers to execute arbitrary commands by manipulating the operation argument.
Path Traversal Vulnerability in UsamaK98 python-notebook-mcp
3 rules 1 TTP 1 CVEA path traversal vulnerability exists in the create_notebook/read_notebook/edit_cell/add_cell functions of server.py in UsamaK98's python-notebook-mcp, allowing remote attackers to access arbitrary files.
AWP Classifieds WordPress Plugin SQL Injection Vulnerability
2 rules 1 TTP 1 CVEThe AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the 'regions' parameter array keys in versions up to, and including, 4.4.5, potentially allowing unauthenticated attackers to extract sensitive information from the database.
WordPress Mentoring Plugin Privilege Escalation Vulnerability
2 rules 1 TTP 1 CVEThe Mentoring plugin for WordPress is vulnerable to privilege escalation, allowing unauthenticated attackers to register with administrator-level user accounts due to improper role restriction in the mentoring_process_registration() function.
Axle-Bucamp MCP-Docusaurus Path Traversal Vulnerability
2 rules 1 TTP 1 CVEA path traversal vulnerability exists in Axle-Bucamp MCP-Docusaurus versions up to commit 404bc028e15ec304c9a045528560f4b5f27a17e0, allowing remote attackers to access sensitive files by manipulating the DOCS_DIR/path argument in specific functions.
A-G-U-P-T-A wireshark-mcp OS Command Injection Vulnerability
2 rules 1 TTP 1 CVEA-G-U-P-T-A wireshark-mcp is vulnerable to remote OS command injection (CVE-2026-7785) via manipulation of the `quick_capture` function in `pyshark_mcp.py`, potentially allowing attackers to execute arbitrary commands on the system.
RTGS2017 NagaAgent Path Traversal Vulnerability
2 rules 2 TTPs 1 CVERTGS2017 NagaAgent up to version 5.1.0 is vulnerable to path traversal via manipulation of the 'Name' argument in the Skills Endpoint, potentially leading to unauthorized file access.
Google Android Remote Code Execution Vulnerability
2 rules 1 TTP 1 CVEA vulnerability in Google Android allows a remote attacker to execute arbitrary code, affecting versions prior to 14, 15, 16 and 16-qpr2 before the May 4, 2026 patch.
Multiple Vulnerabilities in Apache HTTP Server Allow Remote Code Execution, Privilege Escalation, and Denial of Service
3 rules 3 TTPs 5 CVEsMultiple vulnerabilities in Apache HTTP Server versions prior to 2.4.67 can allow remote attackers to execute arbitrary code, escalate privileges, or cause a denial of service.
Multiple Vulnerabilities in PaperCut Allow Data Confidentiality Breach and Security Policy Bypass
2 rules 2 TTPs 3 CVEsMultiple vulnerabilities in PaperCut Embedded App versions prior to 2.2.0 on Ricoh devices and PaperCut NG/MF versions prior to 25.0.11 allow attackers to compromise data confidentiality and bypass security policies, potentially leading to unauthorized access and control.
Traefik Data Confidentiality Vulnerability
2 rules 1 TTPA vulnerability in Traefik allows an attacker to compromise the confidentiality of data, affecting versions v2.11.x prior to v2.11.44, v3.6.x prior to v3.6.15, and v3.7.0-rc.x prior to v3.7.0-rc.3.
Malicious mysten-metrics Crate Exfiltrates Build Machine Data
2 rules 1 TTPThe `mysten-metrics` crate was removed from crates.io after it was found to contain a malicious build script that attempted to exfiltrate data from the build machine during the build process.
Malicious sui-execution-cut Crate Exfiltrates Build Machine Data
2 rules 1 TTPThe `sui-execution-cut` crate on crates.io contained a build script designed to exfiltrate data from the build machine during the build process.
Kubernetes Pod Exec Sensitive File or Credential Path Access
2 rules 3 TTPsThis rule detects Kubernetes pod exec sessions where the decoded command line references sensitive files or paths such as mounted service account tokens, kubelet and control-plane configuration, host identity stores, private keys, and process environment dumps, aiming to identify potential lateral movement, privilege escalation, or credential theft.
Pelican Web UI Privilege Escalation Vulnerability
2 rules 1 TTP 1 IOCA privilege escalation vulnerability in Pelican WebUI versions v7.21 to v7.24 allows authenticated users to gain admin privileges by manipulating database records, potentially leading to configuration modification, API token creation, and password changes.
AzuraCast Liquidsoap Code Injection in Remote Relay Password
3 rules 4 TTPsAzuraCast is vulnerable to a Liquidsoap code injection vulnerability due to the incomplete migration from `cleanUpString()` to `toRawString()` in the remote relay password field, allowing a user with the `RemoteRelays` station permission to inject arbitrary Liquidsoap code by exploiting nested interpolation syntax, leading to arbitrary code execution, API key disclosure, and station disruption.
Potential Direct Kubelet API Access via Process Arguments
2 rules 3 TTPsThis rule detects potential direct Kubelet API access attempts on Linux by identifying process executions whose arguments contain URLs targeting Kubelet ports (10250/10255) enabling discovery and lateral movement in Kubernetes environments.
Pillow Out-of-Bounds Write Vulnerability in PSD Processing (CVE-2026-42311)
2 rules 1 TTP 1 CVEPillow versions 10.3.0 through 12.1.1 are vulnerable to an out-of-bounds write in PSD image decoding/encoding due to an integer overflow when computing tile extent sums, potentially leading to arbitrary code execution.
Argo Workflows Credentials Exposed in Pod Logs
2 rules 1 TTP 1 CVEArgo Workflows versions 4.0.0 to 4.0.4 log artifact repository credentials in plaintext, allowing users with read access to pod logs to extract sensitive information such as S3 access keys and GCS service account keys.
Argo Workflows Template Referencing Restriction Bypass
3 rules 2 TTPs 1 CVEArgo Workflows has an incomplete fix for CVE-2026-31892, allowing bypass of templateReferencing restrictions to modify pod specifications, leading to potential privilege escalation and security context overrides.
Argo Workflows Webhook Interceptor Vulnerable to Unauthenticated Memory Exhaustion (CVE-2026-42294)
2 rules 1 TTPArgo Workflows is vulnerable to a denial-of-service (DoS) attack due to unbounded memory allocation in the Webhook Interceptor component.
Contact Form 7 WordPress Plugin Uncontrolled Resource Consumption Vulnerability
2 rules 1 TTP 1 CVEThe Contact Form 7 WordPress plugin through version 2.6.7 is vulnerable to uncontrolled resource consumption, allowing unauthenticated attackers to exhaust server memory and crash the PHP process by supplying an arbitrarily large integer value to the REST API endpoint, leading to unbounded loop execution.
Arelle Unauthenticated Remote Code Execution Vulnerability
2 rules 1 TTP 1 CVEArelle before 2.39.10 is vulnerable to unauthenticated remote code execution via the /rest/configure REST endpoint, allowing attackers to execute arbitrary Python code by supplying a malicious URL through the plugins parameter.
WordPress Easy PayPal Events & Tickets Plugin Information Disclosure Vulnerability
2 rules 1 TTP 1 CVEAn information disclosure vulnerability in the Easy PayPal Events & Tickets WordPress plugin (versions 1.3 and earlier) allows unauthenticated attackers to enumerate and retrieve all customer order records via the scan_qr.php endpoint.
WordPress Easy PayPal Events & Tickets Plugin Authentication Bypass Vulnerability
2 rules 1 TTP 1 CVE 1 IOCAn unauthenticated remote attacker can exploit a hardcoded authentication bypass vulnerability in the Easy PayPal Events & Tickets plugin for WordPress (versions 1.3 and earlier) by providing 'test' as the hash parameter, allowing retrieval of sensitive order details.
BusyBox DHCPv6 Client Heap Buffer Overflow Vulnerability (CVE-2026-29004)
2 rules 2 TTPs 1 CVEA heap buffer overflow vulnerability in BusyBox's DHCPv6 client allows network-adjacent attackers to trigger memory corruption, denial of service, or arbitrary code execution via crafted DHCPv6 responses.
OpenMRS Module Upload Path Traversal Vulnerability
2 rules 1 TTPOpenMRS versions 2.7.8 and earlier, as well as versions 2.8.0 through 2.8.5, are vulnerable to a path traversal (Zip Slip) attack via the `POST /openmrs/ws/rest/v1/module` endpoint that allows authenticated attackers to achieve arbitrary file write and remote code execution.
Quarkus Vertx HTTP Authorization Bypass via Matrix Parameters
2 rules 2 TTPsQuarkus Vertx HTTP versions < 3.20.6.1, >= 3.21.0 and < 3.27.3.1, >= 3.30.0 and < 3.33.1.1, and >= 3.34.0 and < 3.35.1.1 are vulnerable to an authorization bypass where appending a semicolon and arbitrary text to the request URL allows unauthorized access to protected resources.
Qualcomm PLC FW Buffer Overflow via Incorrect Authorization (CVE-2026-25293)
2 rules 2 TTPs 1 CVECVE-2026-25293 is a critical buffer overflow vulnerability in Qualcomm PLC FW due to incorrect authorization, potentially allowing unauthorized access and control over programmable logic controllers.