April 2026 (30)
OpenClaw Unauthenticated WebSocket Denial-of-Service Vulnerability
2 rules 1 TTP 1 CVEOpenClaw before 2026.3.28 is vulnerable to a denial-of-service attack by accepting unbounded concurrent unauthenticated WebSocket upgrades, allowing attackers to exhaust server resources.
OpenClaw Exec Allowlist Bypass Vulnerability (CVE-2026-41390)
2 rules 2 TTPs 1 CVEOpenClaw before version 2026.3.28 contains an exec allowlist bypass vulnerability (CVE-2026-41390) that allows attackers to persist trust for wrapper binaries like /usr/bin/script to execute different underlying programs, potentially leading to privilege escalation.
LLM-Based Compromised User Triage
2 rules 2 TTPsThis rule correlates multiple security alerts involving the same user, analyzes them with an LLM, and flags potentially compromised accounts based on MITRE tactics, geographic anomalies, and multi-host activity, helping analysts prioritize users exhibiting indicators of credential theft or unauthorized access.
OpenSSH Authentication Bypass Vulnerability
2 rules 1 TTPA vulnerability in OpenSSH could allow for authentication bypass, potentially granting an attacker root access to vulnerable servers running the protocol.
D-Link DIR-825M Remote Buffer Overflow Vulnerability
2 rules 1 TTP 1 CVED-Link DIR-825M version 1.1.12 is vulnerable to a buffer overflow via manipulation of the submit-url argument in the /boafrm/formWanConfigSetup file's sub_414BA8 function, allowing a remote attacker to execute arbitrary code.
UNC6692 Combines Social Engineering, Malware, and Cloud Abuse
2 rules 12 TTPsUNC6692 is a newly discovered, financially motivated threat actor that combines social engineering via Microsoft Teams, custom malware named SNOWBELT, and abuse of legitimate AWS S3 cloud infrastructure in its attack campaigns to steal credentials and prepare for data exfiltration.
VECT Ransomware Destroys Files Due to Encryption Flaw
2 rules 1 TTPVECT 2.0 ransomware, a RaaS offering, permanently destroys large files due to an encryption flaw, discarding decryption nonces for files above 128 KB, rendering them unrecoverable and effectively acting as a wiper; it uses raw ChaCha20-IETF with no authentication.
Broadcom Addresses Critical Vulnerabilities in VMware Tanzu Products
2 rulesBroadcom released a security advisory addressing critical vulnerabilities in VMware Tanzu Data Lake (versions prior to 4.0.0) and VMware Tanzu Greenplum Platform Extension Framework (versions prior to 8.0.0), requiring immediate patching to prevent potential exploitation.
ChatGPTNextWeb NextChat Server-Side Request Forgery Vulnerability
2 rules 1 TTP 1 CVEA server-side request forgery (SSRF) vulnerability in ChatGPTNextWeb NextChat up to version 2.16.1 allows remote attackers to manipulate the proxyHandler function, potentially leading to unauthorized internal resource access.
mkdocs-mcp-plugin Path Traversal Vulnerability
2 rules 1 TTP 1 CVEA path traversal vulnerability exists in douinc mkdocs-mcp-plugin up to version 0.4.1, allowing remote attackers to access unauthorized files through manipulation of the docs_dir/file_path argument in the read_document/list_documents functions within server.py.
SourceCodester Pharmacy Sales and Inventory System SQL Injection Vulnerability
2 rules 1 TTP 1 CVEA remote SQL injection vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0 via manipulation of the ID parameter in the /ajax.php?action=delete_category endpoint, potentially leading to unauthorized data access or modification.
Spring AI Vulnerabilities CVE-2026-40967 and CVE-2026-40978
2 rules 1 TTP 2 CVEsSpring released security advisories on April 27, 2026, to address a VectorStore FilterExpression Converter injection vulnerability (CVE-2026-40967) and a SQL Injection vulnerability (CVE-2026-40978) in Spring AI versions prior to 1.0.6 and 1.1.5.
Tenda HG3 v2.0 Stack-Based Buffer Overflow in formUploadConfig
2 rules 2 TTPs 1 CVEA stack-based buffer overflow vulnerability in the formUploadConfig function of Tenda HG3 v2.0's /boaform/formIPv6Routing file allows remote attackers to execute arbitrary code by manipulating the destNet argument.
AVACAST DLL Hijacking Vulnerability (CVE-2026-7279)
2 rules 1 TTP 1 CVEA DLL hijacking vulnerability in eMPIA Technology's AVACAST (CVE-2026-7279) allows authenticated local attackers to achieve arbitrary code execution with system privileges by placing a malicious DLL in a specific directory.
Detection of Github Delete Actions in Audit Logs
2 rules 1 TTPThis brief focuses on detecting deletion actions within GitHub audit logs, specifically targeting the deletion of codespaces, environments, projects, and repositories, potentially indicating malicious activity or insider threats.
D-Link DI-8100 Buffer Overflow Vulnerability
2 rules 1 TTP 1 CVEA remote buffer overflow vulnerability exists in D-Link DI-8100 version 16.07.26A1's file_exten_asp function, allowing code execution by manipulating the 'Name' argument.
Totolink A8000RU OS Command Injection Vulnerability
2 rules 1 TTP 1 CVETotolink A8000RU version 7.1cu.643_b20200521 is vulnerable to OS command injection via manipulation of the `wifiOff` argument in the `setWiFiBasicCfg` function of the `/cgi-bin/cstecgi.cgi` CGI handler, allowing a remote attacker to execute arbitrary commands on the system.
D-Link DI-8100 Remote Buffer Overflow Vulnerability
2 rules 1 TTP 1 CVEA buffer overflow vulnerability in the D-Link DI-8100 router allows remote attackers to execute arbitrary code by manipulating the 'fn' argument in the tgfile_htm function of the CGI endpoint.
Totolink A8000RU Command Injection Vulnerability (CVE-2026-7244)
3 rules 1 TTP 1 CVEA critical OS command injection vulnerability (CVE-2026-7244) exists in the setWiFiEasyGuestCfg function of the /cgi-bin/cstecgi.cgi file in Totolink A8000RU version 7.1cu.643_b20200521, allowing remote attackers to execute arbitrary commands.
Totolink A8000RU OS Command Injection Vulnerability
2 rules 1 TTP 1 CVEA remote OS command injection vulnerability exists in the setOpenVpnClientCfg function of the Totolink A8000RU router (version 7.1cu.643_b20200521) via manipulation of the 'enabled' argument in the /cgi-bin/cstecgi.cgi CGI handler.
VMware Tanzu Spring Boot Multiple Vulnerabilities
2 rules 4 TTPsMultiple vulnerabilities in VMware Tanzu Spring Boot allow attackers to execute arbitrary code, bypass security measures, manipulate or disclose sensitive data, or hijack authenticated users.
Multiple Vulnerabilities in Atlassian Products
2 rules 4 TTPs 26 CVEsMultiple vulnerabilities in Atlassian Bamboo, Bitbucket, Confluence, Jira, and Jira Service Management allow attackers to execute arbitrary code, bypass security measures, manipulate data, disclose information, or perform cross-site scripting attacks.
AgiFlow scaffold-mcp Path Traversal Vulnerability (CVE-2026-7237)
2 rules 1 TTP 1 CVEA path traversal vulnerability (CVE-2026-7237) exists in AgiFlow scaffold-mcp versions up to 1.0.27, allowing remote attackers to write to arbitrary files by manipulating the file_path argument in the write-to-file tool.
Totolink A8000RU OS Command Injection Vulnerability (CVE-2026-7240)
2 rules 1 TTP 1 CVECVE-2026-7240 is a critical OS command injection vulnerability in the Totolink A8000RU router that allows remote attackers to execute arbitrary commands by manipulating the 'User' argument in the 'setVpnAccountCfg' function.
BrowserOperator Core Path Traversal Vulnerability (CVE-2026-7234)
2 rules 1 TTP 1 CVEA path traversal vulnerability (CVE-2026-7234) exists in BrowserOperator browser-operator-core up to version 0.6.0, allowing remote attackers to read arbitrary files by manipulating the request.url argument in the startsWith function of scripts/component_server/server.js.
Totolink N300RT Buffer Overflow Vulnerability (CVE-2026-7219)
2 rules 1 TTP 1 CVEA remote buffer overflow vulnerability exists in Totolink N300RT 3.4.0-B20250430 via manipulation of the 'entry_name' argument in the /boafrm/formIpQoS file, potentially leading to arbitrary code execution.
edvardlindelof notes-mcp Path Traversal Vulnerability (CVE-2026-7212)
2 rules 1 TTP 1 CVEA path traversal vulnerability exists in edvardlindelof notes-mcp up to version 0.1.4, affecting the notes_mcp.py file, allowing a remote attacker to access sensitive files by manipulating the `root_dir/path` argument.
Path Traversal Vulnerability in engineer-your-data
2 rules 1 TTP 1 CVEA path traversal vulnerability (CVE-2026-7214) exists in eghuzefa's engineer-your-data up to version 0.1.3, allowing remote attackers to read or write arbitrary files by manipulating the WORKSPACE_PATH argument.
Duartium papers-mcp-server Path Traversal Vulnerability (CVE-2026-7205)
2 rules 1 TTP 1 CVEA path traversal vulnerability exists in the `search_papers` function of `src/main.py` in duartium papers-mcp-server version 9ceb3812a6458ba7922ca24a7406f8807bc55598, allowing remote attackers to read arbitrary files by manipulating the `topic` argument, with a public exploit available.
dvladimirov MCP Git Search API Command Injection Vulnerability
2 rules 1 TTP 1 CVEA command injection vulnerability (CVE-2026-7211) exists in the GitSearchRequest function of dvladimirov MCP up to version 0.1.0, allowing a remote attacker to execute arbitrary commands by manipulating the repo_url or pattern argument.