April 2026 (30)
Tenda F451 Router Buffer Overflow Vulnerability
2 rules 2 TTPs 1 CVEA buffer overflow vulnerability in the Tenda F451 router allows remote attackers to execute arbitrary code by manipulating the 'dips' argument in the fromGstDhcpSetSer function.
Tenda F451 Router Buffer Overflow Vulnerability
2 rules 2 TTPsA buffer overflow vulnerability (CVE-2026-6631) in Tenda F451 router version 1.0.0.7_cn_svn7958 allows remote attackers to execute arbitrary code by manipulating the 'page' argument in the /goform/webExcptypemanFilter component.
Metasoft MetaCRM SQL Injection Vulnerability (CVE-2026-6629)
2 rules 1 TTPA SQL injection vulnerability (CVE-2026-6629) exists in Metasoft MetaCRM up to version 6.4.0, allowing remote attackers to execute arbitrary SQL commands via manipulation of the sql argument in the Statement.executeUpdate function of the sql.jsp file.
Langflow Multiple Vulnerabilities
2 rules 2 TTPsMultiple vulnerabilities in Langflow allow an attacker to manipulate files, disclose sensitive information, or conduct cross-site scripting attacks.
Multiple Vulnerabilities in Gitea
1 rule 1 TTPMultiple vulnerabilities in Gitea could allow an attacker to disclose information, bypass security measures, and perform cross-site scripting attacks.
Multiple Vulnerabilities in Firebird Database Server
2 rules 3 TTPsMultiple vulnerabilities in Firebird allow an attacker to execute arbitrary code with administrator privileges, disclose sensitive information, or cause a denial-of-service condition.
Moxi Blog v2 <= 5.2 Server-Side Request Forgery Vulnerability
2 rules 1 TTP 1 CVEA server-side request forgery (SSRF) vulnerability exists in moxi624 Mogu Blog v2 up to version 5.2, specifically affecting the `LocalFileServiceImpl.uploadPictureByUrl` function, allowing remote attackers to potentially interact with internal resources.
ThreatSonar Anti-Ransomware Arbitrary File Deletion Vulnerability
2 rules 2 TTPs 1 CVETeamT5's ThreatSonar Anti-Ransomware is vulnerable to arbitrary file deletion via path traversal, allowing authenticated remote attackers with web access to delete arbitrary files on the system.
Digiwin EasyFlow .NET SQL Injection Vulnerability (CVE-2026-5963)
2 rules 1 TTPDigiwin EasyFlow .NET is vulnerable to SQL Injection, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
Digiwin EasyFlow .NET SQL Injection Vulnerability (CVE-2026-5964)
2 rules 1 TTP 1 CVEDigiwin's EasyFlow .NET is susceptible to a SQL Injection vulnerability, enabling unauthenticated remote attackers to inject arbitrary SQL commands for unauthorized database access, modification, and deletion.
Modelscope Agentscope Code Injection Vulnerability (CVE-2026-6603)
2 rules 1 TTPA code injection vulnerability exists in modelscope agentscope up to version 1.0.18, specifically affecting the execute_python_code/execute_shell_command functions, allowing for remote code execution.
Silex Technology SD-330AC and AMC Manager Insecure Default Password Vulnerability (CVE-2026-32965)
2 rules 1 CVESilex Technology's SD-330AC and AMC Manager are vulnerable to insecure default initialization, allowing a null string password to be set upon initial network connection (CVE-2026-32965).
Langflow Unrestricted File Upload Vulnerability (CVE-2026-6596)
2 rules 2 TTPsAn unrestricted file upload vulnerability in langflow-ai langflow versions up to 1.1.0 allows remote attackers to execute arbitrary code via the create_upload_file function in the API Endpoint.
brikcss merge Prototype Pollution Vulnerability (CVE-2026-6594)
2 rules 2 TTPs 1 CVEA prototype pollution vulnerability (CVE-2026-6594) in brikcss merge up to version 1.3.0 allows remote attackers to modify object prototype attributes by manipulating the __proto__/constructor.prototype/prototype argument.
H3C Magic B1 Router Buffer Overflow Vulnerability
2 rules 1 TTP 1 CVEA buffer overflow vulnerability (CVE-2026-6581) in H3C Magic B1 routers allows remote attackers to execute arbitrary code by manipulating the 'param' argument in the SetMobileAPInfoById function.
liangliangyy DjangoBlog Hardcoded Cryptographic Key Vulnerability (CVE-2026-6580)
2 rules 1 CVECVE-2026-6580 describes a vulnerability in liangliangyy DjangoBlog up to version 2.1.0.0 where manipulation of the 'key' argument in the Amap API Call Handler leads to the use of a hard-coded cryptographic key, enabling remote exploitation.
liangliangyy DjangoBlog Authentication Bypass Vulnerability (CVE-2026-6577)
2 rules 1 TTP 1 CVEA critical authentication bypass vulnerability in liangliangyy DjangoBlog up to version 2.1.0.0 (CVE-2026-6577) allows remote attackers to inject arbitrary GPS data without authentication via the logtracks endpoint, potentially leading to data manipulation and unauthorized access.
Apple Account Notification Phishing Campaign
2 rules 1 TTP 5 IOCsA phishing campaign is abusing legitimate Apple account change notifications to deliver fake iPhone purchase scams, tricking users into calling malicious support numbers.
osuuu LightPicture Hardcoded Credentials Vulnerability (CVE-2026-6574)
2 rules 1 TTP 1 CVECVE-2026-6574 allows remote attackers to manipulate the 'key' argument in the /public/install/lp.sql file via the API Upload Endpoint in osuuu LightPicture <= 1.2.2, leading to hardcoded credentials exposure.
KodExplorer Path Traversal Vulnerability (CVE-2026-6568)
2 rules 1 TTP 1 CVE 1 IOCKodExplorer up to version 4.52 is vulnerable to a path traversal attack via manipulation of the path argument in the share.class.php::initShareOld function, potentially allowing remote attackers to access sensitive files.
H3C Magic B0 Router Buffer Overflow Vulnerability (CVE-2026-6560)
2 rules 1 TTP 1 CVEA buffer overflow vulnerability (CVE-2026-6560) in H3C Magic B0 up to 100R002 allows remote attackers to execute arbitrary code by manipulating the 'param' argument in the Edit_BasicSSID function of the /goform/aspForm file.
DNN (DotNetNuke) SVG Upload Vulnerability (CVE-2026-40321)
2 rules 3 TTPs 1 CVEDNN (formerly DotNetNuke) before 10.2.2 is vulnerable to stored cross-site scripting (XSS) via malicious SVG file uploads, potentially leading to account takeover and arbitrary code execution.
Dolibarr OS Command Injection via MAIN_ODT_AS_PDF Configuration
2 rules 1 TTP 1 CVEDolibarr versions 22.0.4 and earlier are vulnerable to OS Command Injection via the MAIN_ODT_AS_PDF configuration, allowing an authenticated administrator to inject a malicious payload, leading to arbitrary operating system command execution.
FastGPT NoSQL Injection Vulnerability (CVE-2026-40351)
2 rules 1 TTP 1 CVEFastGPT versions before 4.14.9.5 are vulnerable to NoSQL injection, allowing unauthenticated attackers to bypass authentication and gain administrative access.
OpenClaw Matrix Room Control Command Authorization Bypass
2 rules 2 TTPsA vulnerability in OpenClaw versions greater than 2026.3.28 and before 2026.4.15 allowed a Matrix sender paired via DM to bypass room authorization boundaries and execute room control commands without proper authorization.
OpenClaw Webchat Media Embedding Local-Root Containment Bypass
2 rules 2 TTPsA vulnerability in OpenClaw versions 2026.4.7 to before 2026.4.15 allows a crafted tool-result media reference to cause the host to attempt local file reads or Windows UNC/network path access, potentially disclosing files or network credentials.
Payouts King Ransomware Abusing QEMU VMs for Defense Evasion
2 rules 8 TTPs 1 CVE 1 IOCThe Payouts King ransomware is leveraging QEMU VMs as a reverse SSH backdoor to execute payloads, store malicious files, and establish covert remote access tunnels, bypassing endpoint security measures.
PraisonAI Multiple Backends Vulnerable to SQL Injection via Unvalidated Table Prefix
2 rules 1 TTP 1 CVEPraisonAI is vulnerable to SQL injection across nine database backends due to unsanitized `table_prefix` parameters, and in PostgreSQL due to an unsanitized `schema` parameter, enabling arbitrary SQL execution.
Sentry SAML SSO Improper Authentication Vulnerability
2 rules 1 TTP 1 CVEA critical vulnerability in Sentry's SAML SSO implementation allows account takeover by exploiting improper authentication when multiple organizations are configured, affecting versions 21.12.0 to 26.2.0 and requiring a malicious SAML Identity Provider and knowledge of the victim's email address.
WeGIA SQL Injection Vulnerability (CVE-2026-40285)
2 rules 1 TTP 1 CVEWeGIA versions prior to 3.6.10 are vulnerable to SQL injection via the cpf_usuario POST parameter, allowing authenticated users to query the database under an arbitrary identity.