April 2026 (30)
Modelscope Agentscope Code Injection Vulnerability (CVE-2026-6603)
2 rules 1 TTPA code injection vulnerability exists in modelscope agentscope up to version 1.0.18, specifically affecting the execute_python_code/execute_shell_command functions, allowing for remote code execution.
Silex Technology SD-330AC and AMC Manager Insecure Default Password Vulnerability (CVE-2026-32965)
2 rules 1 CVESilex Technology's SD-330AC and AMC Manager are vulnerable to insecure default initialization, allowing a null string password to be set upon initial network connection (CVE-2026-32965).
Langflow Unrestricted File Upload Vulnerability (CVE-2026-6596)
2 rules 2 TTPsAn unrestricted file upload vulnerability in langflow-ai langflow versions up to 1.1.0 allows remote attackers to execute arbitrary code via the create_upload_file function in the API Endpoint.
brikcss merge Prototype Pollution Vulnerability (CVE-2026-6594)
2 rules 2 TTPs 1 CVEA prototype pollution vulnerability (CVE-2026-6594) in brikcss merge up to version 1.3.0 allows remote attackers to modify object prototype attributes by manipulating the __proto__/constructor.prototype/prototype argument.
H3C Magic B1 Router Buffer Overflow Vulnerability
2 rules 1 TTP 1 CVEA buffer overflow vulnerability (CVE-2026-6581) in H3C Magic B1 routers allows remote attackers to execute arbitrary code by manipulating the 'param' argument in the SetMobileAPInfoById function.
liangliangyy DjangoBlog Hardcoded Cryptographic Key Vulnerability (CVE-2026-6580)
2 rules 1 CVECVE-2026-6580 describes a vulnerability in liangliangyy DjangoBlog up to version 2.1.0.0 where manipulation of the 'key' argument in the Amap API Call Handler leads to the use of a hard-coded cryptographic key, enabling remote exploitation.
liangliangyy DjangoBlog Authentication Bypass Vulnerability (CVE-2026-6577)
2 rules 1 TTP 1 CVEA critical authentication bypass vulnerability in liangliangyy DjangoBlog up to version 2.1.0.0 (CVE-2026-6577) allows remote attackers to inject arbitrary GPS data without authentication via the logtracks endpoint, potentially leading to data manipulation and unauthorized access.
Apple Account Notification Phishing Campaign
2 rules 1 TTP 5 IOCsA phishing campaign is abusing legitimate Apple account change notifications to deliver fake iPhone purchase scams, tricking users into calling malicious support numbers.
osuuu LightPicture Hardcoded Credentials Vulnerability (CVE-2026-6574)
2 rules 1 TTP 1 CVECVE-2026-6574 allows remote attackers to manipulate the 'key' argument in the /public/install/lp.sql file via the API Upload Endpoint in osuuu LightPicture <= 1.2.2, leading to hardcoded credentials exposure.
KodExplorer Path Traversal Vulnerability (CVE-2026-6568)
2 rules 1 TTP 1 CVE 1 IOCKodExplorer up to version 4.52 is vulnerable to a path traversal attack via manipulation of the path argument in the share.class.php::initShareOld function, potentially allowing remote attackers to access sensitive files.
H3C Magic B0 Router Buffer Overflow Vulnerability (CVE-2026-6560)
2 rules 1 TTP 1 CVEA buffer overflow vulnerability (CVE-2026-6560) in H3C Magic B0 up to 100R002 allows remote attackers to execute arbitrary code by manipulating the 'param' argument in the Edit_BasicSSID function of the /goform/aspForm file.
Anviz CrossChex Standard TDS7 PreLogin Encryption Vulnerability
2 rules 1 TTP 1 CVE 1 IOCAnviz CrossChex Standard is vulnerable to unauthorized database access due to the manipulation of TDS7 PreLogin, which disables encryption, leading to plaintext transmission of database credentials.
compressing npm Package Symlink Bypass Vulnerability
3 rules 5 TTPs 1 CVE 1 IOCA vulnerability in the `compressing` npm package (<=v2.1.0) allows for arbitrary file overwrite via symlink path traversal, bypassing a previous patch for CVE-2026-24884.
DNN (DotNetNuke) SVG Upload Vulnerability (CVE-2026-40321)
2 rules 3 TTPs 1 CVEDNN (formerly DotNetNuke) before 10.2.2 is vulnerable to stored cross-site scripting (XSS) via malicious SVG file uploads, potentially leading to account takeover and arbitrary code execution.
Dolibarr OS Command Injection via MAIN_ODT_AS_PDF Configuration
2 rules 1 TTP 1 CVEDolibarr versions 22.0.4 and earlier are vulnerable to OS Command Injection via the MAIN_ODT_AS_PDF configuration, allowing an authenticated administrator to inject a malicious payload, leading to arbitrary operating system command execution.
FastGPT NoSQL Injection Vulnerability (CVE-2026-40351)
2 rules 1 TTP 1 CVEFastGPT versions before 4.14.9.5 are vulnerable to NoSQL injection, allowing unauthenticated attackers to bypass authentication and gain administrative access.
OpenClaw Webchat Media Embedding Local-Root Containment Bypass
2 rules 2 TTPsA vulnerability in OpenClaw versions 2026.4.7 to before 2026.4.15 allows a crafted tool-result media reference to cause the host to attempt local file reads or Windows UNC/network path access, potentially disclosing files or network credentials.
Payouts King Ransomware Abusing QEMU VMs for Defense Evasion
2 rules 8 TTPs 1 CVE 1 IOCThe Payouts King ransomware is leveraging QEMU VMs as a reverse SSH backdoor to execute payloads, store malicious files, and establish covert remote access tunnels, bypassing endpoint security measures.
PraisonAI Multiple Backends Vulnerable to SQL Injection via Unvalidated Table Prefix
2 rules 1 TTP 1 CVEPraisonAI is vulnerable to SQL injection across nine database backends due to unsanitized `table_prefix` parameters, and in PostgreSQL due to an unsanitized `schema` parameter, enabling arbitrary SQL execution.
Sentry SAML SSO Improper Authentication Vulnerability
2 rules 1 TTP 1 CVEA critical vulnerability in Sentry's SAML SSO implementation allows account takeover by exploiting improper authentication when multiple organizations are configured, affecting versions 21.12.0 to 26.2.0 and requiring a malicious SAML Identity Provider and knowledge of the victim's email address.
WeGIA SQL Injection Vulnerability (CVE-2026-40285)
2 rules 1 TTP 1 CVEWeGIA versions prior to 3.6.10 are vulnerable to SQL injection via the cpf_usuario POST parameter, allowing authenticated users to query the database under an arbitrary identity.
Firebird Server Denial-of-Service Vulnerability (CVE-2026-28224)
2 rules 1 TTP 1 CVEAn unauthenticated attacker can trigger a denial-of-service condition on vulnerable Firebird servers by sending a specially crafted op_crypt_key_callback packet, leading to a null pointer dereference and server crash.
NovumOS Local Privilege Escalation via Unvalidated Syscall
3 rules 1 TTP 1 CVEA local privilege escalation vulnerability exists in NovumOS versions before 0.24, where Syscall 12 (JumpToUser) lacks input validation, allowing user-mode processes to execute arbitrary code in kernel mode.
NovumOS MemoryMapRange Privilege Escalation Vulnerability (CVE-2026-40572)
2 rules 1 TTP 1 CVEA vulnerability exists in NovumOS versions prior to 0.24 where the MemoryMapRange syscall allows user-mode processes to map arbitrary virtual address ranges, including kernel structures, leading to privilege escalation.
SecureDrop Client Code Execution via Gzip Extraction Vulnerability
2 rules 1 TTP 2 CVEsA compromised SecureDrop server can achieve code execution on the SecureDrop client's virtual machine by exploiting improper filename validation during gzip archive extraction, allowing for the overwriting of critical files.
Dagster SQL Injection Vulnerability in Dynamic Partition Keys
2 rules 6 TTPsA SQL injection vulnerability exists in Dagster's DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers, where a user with 'Add Dynamic Partitions' permission can inject arbitrary SQL due to improper escaping of dynamic partition key values, leading to unauthorized data access or modification.
YesWiki Authenticated SQL Injection Vulnerability
2 rules 1 TTP 2 IOCsYesWiki is vulnerable to authenticated SQL Injection via the id_fiche parameter in the EntryManager::formatDataBeforeSave() function, allowing attackers to inject arbitrary SQL commands and potentially extract sensitive data.
Movary Privilege Escalation Vulnerability (CVE-2026-40349)
2 rules 1 TTP 1 CVEMovary versions prior to 0.71.1 allow authenticated users to escalate privileges to administrator by manipulating the `isAdmin` field via a PUT request to the `/settings/users/{userId}` endpoint, due to missing authorization checks.
Movary SSRF Vulnerability (CVE-2026-40348)
2 rules 2 TTPs 1 CVEMovary versions before 0.71.1 are vulnerable to server-side request forgery (SSRF) via the `/settings/jellyfin/server-url-verify` endpoint, allowing authenticated users to probe internal network resources.
FastGPT NoSQL Injection Vulnerability in Password Change Endpoint
2 rules 2 TTPs 1 CVEFastGPT versions prior to 4.14.9.5 are vulnerable to NoSQL injection in the password change endpoint, allowing authenticated attackers to bypass password verification and perform account takeover.