Tag
Thumbor Path Traversal via URL Decoding Bypass
1 rule 2 TTPs 1 CVE 1 IOCThumbor version 7.7.7 and earlier is vulnerable to arbitrary file read via a path traversal flaw in file_loader.py, where security checks are performed before decoding percent-encoded traversal sequences.
Auth.js getToken() Vulnerability Leads to Denial of Service
1 TTPA vulnerability in the Auth.js `getToken()` helper function (next-auth and @auth/core) allows unauthenticated attackers to trigger an uncaught exception via a malformed `Authorization: Bearer` header, leading to a per-request denial of service in affected applications.
Improper Input Validation in boazsegev facil.io WebSocket Frame Parser (CVE-2026-16632)
1 TTP 1 CVEA high-severity improper input validation vulnerability, CVE-2026-16632, exists in the `websocket_on_protocol_error` function of the `boazsegev facil.io` WebSocket Frame Parser, allowing a remote unauthenticated attacker to manipulate the `on_message` argument with a publicly available exploit, potentially leading to denial of service or information disclosure.
CVE-2026-0238: Palo Alto Networks Broker VM Improper Input Validation
2 rulesCVE-2026-0238 is an improper input validation vulnerability in Palo Alto Networks Broker VM that allows an authenticated administrator to inject arbitrary content into certain fields, affecting versions 30.0 prior to 30.0.24.
Free5GC UDM Information Disclosure via Malformed Request
2 rules 2 TTPs 1 CVEThe free5GC UDM component fails to validate the `supi` path parameter in six GET handlers, allowing an unauthenticated attacker to inject control characters and trigger a `500 Internal Server Error` that exposes internal infrastructure details.
OpenClaw Input Validation Vulnerability Allows Privilege Escalation
2 rules 1 TTP 1 CVEOpenClaw before version 2026.4.10 contains an input validation vulnerability (CVE-2026-43534) allowing external hook metadata to be enqueued as trusted system events, enabling attackers to escalate privileges.
Microsoft PowerShell Improper Input Validation Vulnerability (CVE-2026-26143)
2 rules 1 TTP 1 CVEAn improper input validation vulnerability (CVE-2026-26143) in Microsoft PowerShell allows an unauthorized local attacker to bypass security features.
Adobe ColdFusion Improper Input Validation Vulnerability (CVE-2026-27306)
2 rules 1 TTP 1 CVEAn improper input validation vulnerability in Adobe ColdFusion versions 2023.18, 2025.6, and earlier (CVE-2026-27306) could lead to arbitrary code execution if a privileged user opens a specially crafted malicious file.
Rapid7 Velociraptor Improper Input Validation Vulnerability
2 rules 1 TTP 1 CVERapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability allowing authenticated remote attackers to achieve remote code execution on the server.
Android-ImageMagick7 Improper Input Validation Vulnerability (CVE-2026-4755)
2 rules 3 TTPsA CWE-20 improper input validation vulnerability exists in MolotovCherry Android-ImageMagick7 before version 7.1.2-11, potentially allowing for remote code execution or denial of service.