April 2026 (30)
IBM Langflow Desktop Deserialization RCE (CVE-2026-3357)
2 rules 1 TTP 1 CVEIBM Langflow Desktop versions 1.6.0 through 1.8.2 is vulnerable to arbitrary code execution due to insecure deserialization of untrusted data, allowing an authenticated user to execute code on the system.
IBM Verify Access and Security Verify Access Container Privilege Escalation (CVE-2026-1346)
2 rules 1 TTP 1 CVEA locally authenticated user can escalate privileges to root on vulnerable IBM Verify Identity Access Container and IBM Security Verify Access Container installations due to the execution of processes with unnecessary privileges, as tracked by CVE-2026-1346.
IBM Verify and Security Verify Access Container Server-Side Request Forgery Vulnerability (CVE-2026-1343)
2 rules 2 TTPs 1 CVECVE-2026-1343 allows an attacker to contact internal authentication endpoints protected by the Reverse Proxy in IBM Verify Identity Access Container and IBM Security Verify Access Container.
Amazon Firecracker Virtio PCI Out-of-Bounds Write Vulnerability (CVE-2026-5747)
3 rules 2 TTPs 1 CVEAn out-of-bounds write vulnerability in Amazon Firecracker's virtio PCI transport (CVE-2026-5747) allows a local guest user with root privileges to potentially crash the VMM process or execute arbitrary code on the host.
WWBN AVideo SSRF Vulnerability via Incomplete CVE-2026-27732 Fix
2 rules 1 TTP 2 CVEs 1 IOCWWBN AVideo is vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete fix for CVE-2026-27732, allowing authenticated uploaders to bypass SSRF protection by providing a `downloadURL` with a common media extension, leading to internal response exfiltration.
File Browser Share Links Accessible After Permission Revocation
3 rules 1 TTP 1 CVEFile Browser share links remain accessible after Share/Download permissions are revoked, allowing continued access to shared files even after an administrator revokes the user's permissions.
LiteLLM Authentication Bypass via Password Hash Exposure and Pass-the-Hash
2 rules 1 TTPLiteLLM versions before 1.83.0 stored user passwords as unsalted SHA-256 hashes and exposed these hashes through multiple API endpoints, enabling an authenticated user to retrieve another user's password hash and use it to log in as that user due to the /v2/login endpoint accepting the raw SHA-256 hash without re-hashing, leading to potential privilege escalation.
Emmett Web Framework Path Traversal Vulnerability (CVE-2026-39847)
2 rules 1 TTP 1 CVEEmmett web framework versions 2.5.0 to before 2.8.1 are vulnerable to path traversal attacks (CVE-2026-39847), allowing attackers to read arbitrary files outside the intended assets directory using manipulated URLs.
Unauthenticated Denial-of-Service and Information Disclosure in Podman Desktop
2 rules 4 TTPs 1 CVEPodman Desktop versions prior to 1.26.2 expose an unauthenticated HTTP server, allowing remote attackers to trigger denial-of-service conditions by exhausting resources and extract sensitive information through verbose error responses.
PowerJob OpenAPI Endpoint Code Injection Vulnerability (CVE-2026-5739)
2 rules 1 TTP 1 CVEA code injection vulnerability exists in PowerJob versions 5.1.0, 5.1.1, and 5.1.2, allowing remote attackers to execute arbitrary code via the GroovyEvaluator.evaluate function in the OpenAPI Endpoint component by manipulating the nodeParams argument.
OpenObserve SSRF via Improper IPv6 Validation
2 rules 1 TTP 1 CVEOpenObserve versions 0.70.3 and earlier are vulnerable to a server-side request forgery (SSRF) attack due to improper validation of IPv6 addresses in the validate_enrichment_url function, potentially allowing authenticated attackers to access internal services and retrieve sensitive cloud metadata.
NI LabVIEW Out-of-Bounds Read Vulnerability (CVE-2026-32863)
2 rules 5 TTPs 1 CVEA memory corruption vulnerability due to an out-of-bounds read in NI LabVIEW's `sentry_transaction_context_set_operation()` function could lead to information disclosure or arbitrary code execution by opening a specially crafted VI file.
NI LabVIEW LVCLASS File Parsing Out-of-Bounds Write Vulnerability (CVE-2026-32861)
2 rules 4 TTPs 1 CVEA memory corruption vulnerability exists in NI LabVIEW due to an out-of-bounds write when loading a corrupted LVCLASS file (CVE-2026-32861), potentially leading to information disclosure or arbitrary code execution if a user opens a specially crafted .lvclass file.
NI LabVIEW LVLIB File Parsing Memory Corruption Vulnerability (CVE-2026-32860)
2 rules 2 TTPs 1 CVE 1 IOCA memory corruption vulnerability exists in NI LabVIEW due to an out-of-bounds write when loading a corrupted LVLIB file, potentially leading to information disclosure or arbitrary code execution if a user opens a specially crafted .lvlib file.
NI LabVIEW Memory Corruption Vulnerability (CVE-2026-32862)
2 rules 5 TTPs 1 CVEA memory corruption vulnerability (CVE-2026-32862) in NI LabVIEW versions 2026 Q1 (26.1.0) and prior, stemming from an out-of-bounds write in ResFileFactory::InitResourceMgr(), can lead to information disclosure or arbitrary code execution if a user opens a malicious VI file.
Mise Trust Bypass Vulnerability via Malicious .mise.toml
2 rules 2 TTPsA vulnerability in mise allows an attacker who can place a malicious .mise.toml file in a repository to bypass trust checks and execute arbitrary code via `[env] _.source` due to improper loading of trust settings.
PowerJob SQL Injection Vulnerability (CVE-2026-5736)
2 rules 1 TTP 1 CVEA remote SQL injection vulnerability, CVE-2026-5736, exists in PowerJob versions 5.1.0 through 5.1.2 within the detailPlus Endpoint, potentially allowing unauthenticated attackers to execute arbitrary SQL queries.
Genealogy PHP Application Broken Access Control Vulnerability (CVE-2026-39355)
2 rules 6 TTPs 1 CVEA critical broken access control vulnerability (CVE-2026-39355) in Genealogy PHP application versions prior to 5.9.1 allows authenticated users to transfer ownership of arbitrary teams, leading to complete takeover of team workspaces and unrestricted data access.
ChurchCRM Pre-Authentication Remote Code Execution Vulnerability (CVE-2026-39337)
2 rules 2 TTPs 2 CVEsA critical pre-authentication remote code execution vulnerability in ChurchCRM versions prior to 7.1.0 allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise.
ChurchCRM Authenticated API User Authorization Bypass (CVE-2026-39331)
2 rules 1 TTP 1 CVEAn authenticated API user of ChurchCRM prior to v7.1.0 can bypass authorization checks and modify arbitrary family records by manipulating the familyId parameter in API requests, leading to privilege escalation and potential data manipulation.
ChurchCRM Path Traversal Vulnerability Leading to Remote Code Execution
2 rules 1 TTP 1 CVEA path traversal vulnerability in ChurchCRM versions prior to 6.5.3 allows authenticated administrators to upload arbitrary files, leading to remote code execution by overwriting Apache .htaccess files.
NVIDIA DALI Deserialization Vulnerability (CVE-2026-24156)
2 rules 2 TTPs 1 CVENVIDIA DALI contains a deserialization of untrusted data vulnerability, identified as CVE-2026-24156, which may lead to arbitrary code execution.
NVIDIA Triton Inference Server Denial-of-Service Vulnerability (CVE-2026-24146)
2 rules 1 TTP 1 CVENVIDIA Triton Inference Server is vulnerable to denial of service due to insufficient input validation that, when combined with a large number of outputs, can cause a server crash.
SoftEtherVPN Pre-Authentication Denial-of-Service Vulnerability (CVE-2026-39312)
2 rules 2 TTPs 1 CVESoftEtherVPN version 5.2.5188 and earlier is vulnerable to a pre-authentication denial-of-service attack where an unauthenticated remote attacker can crash the vpnserver process by sending a malformed EAP-TLS packet over raw L2TP (UDP/1701), terminating all active VPN sessions.
PolarLearn Privilege Escalation Vulnerability (CVE-2026-35610)
2 rules 1 TTP 1 CVEPolarLearn version 0-PRERELEASE-14 and earlier contains a privilege escalation vulnerability (CVE-2026-35610) in the account-management module, allowing authenticated non-admin users to execute administrative functions due to an inverted admin check.
Emissary OS Command Injection Vulnerability (CVE-2026-35581)
2 rules 1 TTP 1 CVEEmissary, a P2P data-driven workflow engine, is vulnerable to OS command injection due to insufficient sanitization of the PLACE_NAME parameter in versions prior to 8.39.0, allowing for arbitrary command execution.
Windmill CE/EE SQL Injection Vulnerability
2 rules 3 TTPs 1 CVEWindmill CE/EE versions 1.276.0 through 1.603.2 are vulnerable to SQL injection in the folder ownership management, allowing authenticated attackers to inject SQL through the owner parameter, leading to sensitive data access, token forgery, and arbitrary code execution.
Windmill Missing Authorization Vulnerability (CVE-2026-22683)
2 rules 2 TTPs 1 CVEWindmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability (CVE-2026-22683) that allows users with the Operator role to bypass intended restrictions and perform unauthorized entity creation and modification actions via the backend API, potentially leading to privilege escalation and remote code execution.
libssh Insecure Configuration Allows Local MITM Attacks (CVE-2025-14821)
2 rules 2 TTPs 1 CVECVE-2025-14821 in libssh allows local man-in-the-middle attacks, SSH downgrade attacks, and trusted host manipulation due to insecure default configuration loading from a world-writable directory on Windows.
ChurchCRM SQL Injection Vulnerability (CVE-2026-35567)
2 rules 1 TTP 1 CVEChurchCRM versions prior to 7.1.0 are vulnerable to SQL injection via the NewRole POST parameter, allowing authenticated users with the ManageGroups role to execute arbitrary SQL commands.