April 2026 (30)
CVE-2026-26181 - Microsoft Brokering File System Use-After-Free Vulnerability
2 rules 1 TTP 1 CVECVE-2026-26181 is a use-after-free vulnerability in the Microsoft Brokering File System that enables a locally authenticated attacker to escalate privileges on the system.
CVE-2026-26182: Windows WinSock Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-26182 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock, allowing a locally authorized attacker to elevate privileges.
CVE-2026-27908 Use-After-Free in Windows TDI Translation Driver
2 rules 1 TTP 1 CVEA use-after-free vulnerability, CVE-2026-27908, exists in the Windows TDI Translation Driver (tdx.sys), allowing a locally authenticated attacker to elevate privileges.
CVE-2026-27909 Use-After-Free in Windows Search Component Allows Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-27909 is a use-after-free vulnerability in the Microsoft Windows Search Component that allows a locally authorized attacker to escalate privileges.
CVE-2026-27910: Windows Installer Local Privilege Escalation
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-27910 describes a local privilege escalation vulnerability in Windows Installer due to improper handling of insufficient permissions, allowing an authorized attacker to gain elevated privileges.
CVE-2026-27916 Use-After-Free in Windows UPnP Device Host
2 rules 1 TTP 1 CVECVE-2026-27916 is a use-after-free vulnerability in Windows Universal Plug and Play (UPnP) Device Host that allows an authorized attacker to elevate privileges locally.
CVE-2026-27917: Windows WFP NDIS Lightweight Filter Driver Use-After-Free Vulnerability
2 rules 1 TTP 1 CVECVE-2026-27917 is a use-after-free vulnerability in the Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) that allows a locally authorized attacker to elevate privileges.
CVE-2026-27926 Windows Cloud Files Mini Filter Driver Privilege Escalation
3 rules 1 TTP 1 CVECVE-2026-27926 is a race condition vulnerability in the Windows Cloud Files Mini Filter Driver that allows a local attacker to elevate privileges.
CVE-2026-32071: Windows LSASS Null Pointer Dereference DoS
2 rules 1 TTP 1 CVECVE-2026-32071 is a null pointer dereference vulnerability in the Windows Local Security Authority Subsystem Service (LSASS), allowing an unauthorized network attacker to cause a denial-of-service condition.
CVE-2026-32078: Windows Projected File System Use-After-Free Elevation of Privilege
2 rules 1 TTP 1 CVEA use-after-free vulnerability, CVE-2026-32078, exists in the Windows Projected File System, allowing a locally authenticated attacker to escalate privileges.
CVE-2026-32152 Use-After-Free in Desktop Window Manager
2 rules 1 TTP 1 CVECVE-2026-32152 is a use-after-free vulnerability in the Desktop Window Manager (dwm.exe) that allows an authorized local attacker to elevate privileges.
CVE-2026-32153 Windows Speech Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32153 is a use-after-free vulnerability in Microsoft Windows Speech that allows a locally authorized attacker to elevate privileges.
CVE-2026-32155: Desktop Window Manager Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32155 is a use-after-free vulnerability in the Desktop Window Manager that allows an authorized attacker to escalate privileges locally on a Windows system.
CVE-2026-32157 - Remote Desktop Client Use-After-Free Vulnerability
2 rules 2 TTPs 1 CVECVE-2026-32157 is a use-after-free vulnerability in the Remote Desktop Client that allows an unauthorized attacker to execute code over a network.
CVE-2026-32164 Windows User Interface Core Race Condition Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32164 is a race condition vulnerability in Windows User Interface Core that allows a locally authorized attacker to elevate privileges.
CVE-2026-32195 Windows Kernel Stack-Based Buffer Overflow Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32195 is a stack-based buffer overflow vulnerability in the Windows Kernel that allows an authorized attacker to elevate privileges locally.
CVE-2026-33096 HTTP.sys Out-of-Bounds Read Denial-of-Service
2 rules 2 TTPs 1 CVEAn unauthenticated, remote attacker can exploit an out-of-bounds read vulnerability (CVE-2026-33096) in Windows HTTP.sys to cause a denial-of-service condition.
CVE-2026-33098 Use-After-Free in Windows Container Isolation FS Filter Driver
2 rules 1 TTP 1 CVECVE-2026-33098 is a use-after-free vulnerability in the Windows Container Isolation FS Filter Driver that allows a locally authorized attacker to elevate privileges.
CVE-2026-33099: Windows WinSock Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVEA use-after-free vulnerability, CVE-2026-33099, in the Windows Ancillary Function Driver for WinSock, enables a locally authenticated attacker to elevate privileges on the system.
CVE-2026-33101 Use-After-Free Vulnerability in Windows Print Spooler
2 rules 1 TTP 1 CVECVE-2026-33101 is a use-after-free vulnerability in the Windows Print Spooler Components that allows an authenticated local attacker to elevate privileges.
CVE-2026-33824: Windows IKE Extension Double Free Vulnerability
2 rules 3 TTPs 1 CVEA double free vulnerability in the Windows IKE Extension, tracked as CVE-2026-33824, allows an unauthenticated remote attacker to execute arbitrary code over the network.
CVE-2026-33826: Windows Active Directory Improper Input Validation Vulnerability
2 rules 1 TTP 1 CVEAn improper input validation vulnerability (CVE-2026-33826) in Windows Active Directory could allow an authenticated attacker on an adjacent network to execute code.
Fortinet FortiDDoS-F SQL Injection Vulnerability (CVE-2026-39815)
2 rules 3 TTPs 1 CVEAn SQL injection vulnerability (CVE-2026-39815) in Fortinet FortiDDoS-F versions 7.2.1 through 7.2.2 may allow a low-privilege attacker to execute unauthorized code or commands.
Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-39808)
2 rules 1 TTP 1 CVEFortinet FortiSandbox versions 4.4.0 through 4.4.8 are vulnerable to OS Command Injection (CVE-2026-39808), potentially allowing unauthenticated attackers to execute arbitrary code or commands.
Go Markdown Library Out-of-Bounds Read Vulnerability
2 rules 1 TTPA vulnerability in the go-markdown library exists where processing a malformed input containing a '<' character that is not followed by a '>' character with a SmartypantsRenderer can lead to an out-of-bounds read or a panic, causing a denial of service.
Jetty HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
2 rules 1 TTP 1 CVE 2 IOCsJetty is vulnerable to HTTP request smuggling due to improper parsing of quoted strings in HTTP/1.1 chunked transfer encoding extension values, potentially allowing attackers to inject arbitrary HTTP requests, poison caches, and bypass security controls.
Krayin CRM v2.2.x SQL Injection Vulnerability
2 rules 1 TTP 1 CVEKrayin CRM v2.2.x is vulnerable to SQL injection via the rotten_lead parameter in /Lead/LeadDataGrid.php, potentially allowing attackers to read sensitive data.
Libsixel Use-After-Free Vulnerability (CVE-2026-33018)
2 rules 1 TTP 1 CVEA use-after-free vulnerability exists in libsixel versions 1.8.7 and prior when processing animated GIFs due to improper frame buffer management, potentially leading to code execution.
manikandan580 School-management-system SQL Injection Vulnerability
2 rules 1 TTP 1 CVEA time-based blind SQL injection vulnerability in manikandan580 School-management-system 1.0 allows unauthenticated attackers to potentially execute arbitrary SQL queries and gain unauthorized access to sensitive information.
Microsoft Defender Privilege Escalation Vulnerability (CVE-2026-33825)
2 rules 1 TTP 1 CVECVE-2026-33825 allows a locally authenticated attacker to escalate privileges in Microsoft Defender due to insufficient access control granularity.