Tag
Kirby CMS Missing Authorization Vulnerability in /api/site/find (CVE-2026-54005)
2 rules 3 TTPsAn authenticated user can exploit CVE-2026-54005, a high-severity missing authorization vulnerability in Kirby CMS versions <= 4.9.3 and from 5.0.0-alpha.1 to <= 5.4.3, via the `/api/site/find` REST API route to bypass `pages.access` permissions and retrieve sensitive content and metadata from unauthorized pages.
PraisonAI Call Server Unauthenticated Agent Control API
2 rules 2 TTPsPraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured, allowing attackers to list, inspect, invoke, and unregister agents due to a fail-open authentication default and a default binding to `0.0.0.0`, as tracked by CVE-2026-47396.
GitHub CLI Incorrectly Includes Authorization Header in API Requests
2 rules 1 TTP 3 IOCsGitHub CLI versions 2.92.0 and earlier incorrectly include authorization headers in API requests to TUF repository mirrors and external hosts when using the `gh attestation`, `gh release verify`, and `gh release verify-asset` commands, potentially exposing sensitive tokens.
Entra ID OAuth User Impersonation to Microsoft Graph
2 rules 2 TTPsThis rule detects potential session hijacking or token replay in Microsoft Entra ID, identifying cases where a user signs in and subsequently accesses Microsoft Graph from a different IP address using the same session ID, which may indicate a successful OAuth phishing attack, session hijacking, or token replay attack.
Cisco Secure Workload Unauthorized API Access Vulnerability
1 ruleCisco Secure Workload versions 3.9 and prior, versions prior to 3.10.8.3, and versions prior to 4.0.3.17 are vulnerable to unauthorized API access, requiring an urgent update.
Microsoft Graph Multi-Category Reconnaissance Burst
2 rules 2 TTPsThe rule detects Microsoft Graph activity from delegated user tokens where a single user session and source IP rapidly touches multiple high-value Graph paths indicative of reconnaissance, suggesting a broad enumeration playbook.
PraisonAI Legacy API Server Authentication Bypass (CVE-2026-44338)
2 rules 1 TTP 1 CVEPraisonAI ships a legacy Flask API server with authentication disabled by default, allowing any reachable caller to access `/agents` and trigger the configured `agents.yaml` workflow through `/chat` without providing a token (CVE-2026-44338).
OpenViking Authentication Bypass Vulnerability (CVE-2026-40525)
2 rules 1 TTP 1 CVEOpenViking versions prior to commit c7bb167 are vulnerable to an authentication bypass that allows remote attackers to invoke privileged bot-control functionality without authentication when the api_key configuration is unset or empty, potentially leading to unauthorized access to downstream systems and data.
Paperclip Cross-Tenant Agent API Key IDOR Vulnerability
3 rules 5 TTPsA Paperclip API vulnerability allows a board user from one company to create, list, and revoke agent API keys in another company, leading to full cross-tenant compromise due to insufficient authorization checks on `/agents/:id/keys` routes.
Kimsuky Malware Using Dropbox API for Command and Control
2 rules 2 TTPsKimsuky is using malware that leverages the Dropbox API for command and control, enabling file exfiltration and remote code execution.
Snipe-IT Privilege Escalation via API Permissions Assignment (CVE-2026-44832)
2 rules 1 TTPAn authenticated user with limited 'users.edit' permissions can escalate their privileges to 'admin' in Snipe-IT versions before 8.4.1 by manipulating the permissions array in a PATCH request to the API, as tracked by CVE-2026-44832.
Okta API Token Revoked
2 rules 1 TTPDetection of Okta API token revocation events, indicating potential unauthorized access or compromise.