April 2026 (30)
.NET Uncontrolled Resource Consumption Vulnerability (CVE-2026-26171)
1 rule 1 CVECVE-2026-26171 is a vulnerability in .NET that allows an unauthorized attacker to perform a denial-of-service attack over a network due to uncontrolled resource consumption.
Adobe Acrobat Reader Prototype Pollution Vulnerability (CVE-2026-34622)
2 rules 1 TTP 1 CVEA prototype pollution vulnerability in Adobe Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier (CVE-2026-34622) allows for arbitrary code execution when a user opens a specially crafted malicious file.
Adobe Bridge Heap-Based Buffer Overflow Vulnerability (CVE-2026-27311)
2 rules 1 TTP 1 CVEA heap-based buffer overflow vulnerability in Adobe Bridge versions 16.0.2, 15.1.4, and earlier (CVE-2026-27311) allows for arbitrary code execution when a user opens a specially crafted file.
Adobe Bridge Heap-based Buffer Overflow Vulnerability (CVE-2026-27312)
2 rules 2 TTPs 1 CVEA heap-based buffer overflow vulnerability in Adobe Bridge versions 16.0.2, 15.1.4 and earlier can lead to arbitrary code execution if a user opens a malicious file.
Adobe ColdFusion Improper Input Validation RCE
2 rules 1 TTP 1 CVEAdobe ColdFusion versions 2023.18, 2025.6, and earlier are vulnerable to improper input validation, potentially leading to arbitrary code execution without user interaction.
Adobe ColdFusion Improper Input Validation Vulnerability (CVE-2026-27306)
2 rules 1 TTP 1 CVEAn improper input validation vulnerability in Adobe ColdFusion versions 2023.18, 2025.6, and earlier (CVE-2026-27306) could lead to arbitrary code execution if a privileged user opens a specially crafted malicious file.
Multiple Vulnerabilities in Red Hat Ansible Automation Platform
2 rules 6 TTPsA remote, anonymous attacker can exploit multiple vulnerabilities in Red Hat Ansible Automation Platform to perform denial of service, execute arbitrary code, bypass security measures, manipulate data, disclose information, or conduct XSS attacks.
n8n AI Workflow Automation Platform Abused for Malware Delivery and Device Fingerprinting
2 rules 6 TTPs 2 IOCsThreat actors are abusing the n8n AI workflow automation platform to deliver malware and fingerprint devices via phishing campaigns, bypassing traditional security filters by leveraging trusted infrastructure.
Keycloak Cross-Site Scripting Vulnerability
2 rules 1 TTPAn authenticated remote attacker can exploit a vulnerability in Keycloak to perform a Cross-Site Scripting attack, potentially leading to unauthorized access and data compromise.
Kyverno SSRF Vulnerability in CEL HTTP Library
2 rules 3 TTPs 1 CVE 2 IOCsA Server-Side Request Forgery (SSRF) vulnerability in Kyverno's CEL HTTP library allows users with namespace-scoped policy creation permissions to make arbitrary HTTP requests, enabling unauthorized access to internal services, cloud metadata endpoints, and data exfiltration.
Kyverno Service Account Token Leak via API Call
2 rules 1 TTP 5 IOCsKyverno's apiCall serviceCall helper implicitly injects the Kyverno controller service account token into requests when policies lack an explicit Authorization header, allowing exfiltration to attacker-controlled endpoints and unauthorized actions.
free5gc UDR Improper Path Validation Allows Unauthenticated Access to Traffic Influence Subscriptions
2 rules 2 TTPs 1 IOCAn improper path validation vulnerability exists in the free5gc UDR service, allowing unauthenticated attackers with access to the 5G Service Based Interface (SBI) to read Traffic Influence Subscriptions.
CVE-2026-32183: Windows Snipping Tool Command Injection Vulnerability
2 rules 2 TTPs 1 CVECVE-2026-32183 is a command injection vulnerability in the Windows Snipping Tool that allows a local attacker to execute arbitrary code.
Windows Win32K Untrusted Pointer Dereference Vulnerability (CVE-2026-32222)
2 rules 1 TTP 1 CVECVE-2026-32222 is an untrusted pointer dereference vulnerability in the Windows Win32K ICOMP component, allowing a local attacker to escalate privileges.
CVE-2026-32156 Use-After-Free Vulnerability in Windows UPnP Device Host
2 rules 2 TTPs 1 CVECVE-2026-32156 is a use-after-free vulnerability in the Windows Universal Plug and Play (UPnP) Device Host service that allows an unauthorized attacker to execute code locally.
CVE-2026-26183 Windows RPC API Local Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-26183 allows a locally authenticated attacker to escalate privileges due to improper access control within the Windows RPC API.
Windows Server Update Service (WSUS) Privilege Escalation via CVE-2026-26174
2 rules 1 TTP 1 CVECVE-2026-26174 is a race condition vulnerability in Windows Server Update Service that allows an authorized attacker to elevate privileges locally.
Adobe Connect XSS Vulnerability Leading to Privilege Escalation
2 rules 1 TTP 1 CVEAdobe Connect versions 2025.3, 12.10, and earlier are susceptible to a Cross-Site Scripting (XSS) vulnerability (CVE-2026-34617) that can lead to privilege escalation if a user interacts with a malicious URL or compromised web page.
CVE-2026-33100: Windows WinSock Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-33100 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock, allowing a locally authorized attacker to elevate privileges.
CVE-2026-32224 Use-After-Free in Windows Server Update Service
2 rules 1 TTP 1 CVECVE-2026-32224 is a use-after-free vulnerability in the Windows Server Update Service that allows a locally authenticated attacker to elevate privileges.
Microsoft Graphics Component Heap-based Buffer Overflow Vulnerability (CVE-2026-32221)
2 rules 2 TTPs 1 CVECVE-2026-32221 is a heap-based buffer overflow vulnerability in the Microsoft Graphics Component, allowing a local attacker to execute arbitrary code.
Microsoft Brokering File System Double Free Privilege Escalation (CVE-2026-32219)
2 rules 1 TTP 1 CVECVE-2026-32219 is a double free vulnerability in the Microsoft Brokering File System, allowing an authorized attacker to escalate privileges locally on a vulnerable Windows system.
Microsoft PowerPoint Use-After-Free Vulnerability (CVE-2026-32200)
2 rules 1 TTP 1 CVECVE-2026-32200 is a use-after-free vulnerability in Microsoft Office PowerPoint that allows an unauthorized attacker to achieve local code execution by enticing a user to open a specially crafted PowerPoint document.
.NET Spoofing Vulnerability (CVE-2026-32178)
2 rules 1 TTP 1 CVECVE-2026-32178 is a vulnerability in .NET that allows for network spoofing due to improper neutralization of special elements, potentially enabling attackers to impersonate legitimate entities.
CVE-2026-32165 Use-After-Free in Windows User Interface Core
2 rules 1 TTP 1 CVECVE-2026-32165 is a use-after-free vulnerability in Windows User Interface Core that allows a locally authenticated attacker to elevate privileges.
Windows COM Privilege Escalation via CVE-2026-32162
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-32162 allows an unauthorized attacker to achieve local privilege escalation in Windows COM by exploiting the acceptance of extraneous untrusted data with trusted data.
Windows Push Notifications Race Condition Privilege Escalation (CVE-2026-32159)
2 rules 1 TTP 1 CVECVE-2026-32159 is a race condition vulnerability in Windows Push Notifications, allowing a local attacker with low privileges to elevate privileges by exploiting concurrent execution using a shared resource with improper synchronization.
Microsoft Brokering File System Race Condition Vulnerability (CVE-2026-32091)
2 rules 1 TTP 1 CVECVE-2026-32091 is a race condition vulnerability in the Microsoft Brokering File System, allowing an unauthenticated local attacker to escalate privileges.
CVE-2026-32087 Function Discovery Service Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32087 is a heap-based buffer overflow vulnerability in the Function Discovery Service (fdwsd.dll) that allows an authorized local attacker to elevate privileges on a Windows system.
CVE-2026-32070: Windows CLFS Driver Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVEA use-after-free vulnerability, CVE-2026-32070, exists in the Windows Common Log File System (CLFS) driver, enabling a locally authenticated attacker to escalate privileges on a vulnerable system.