April 2026 (30)
Luanti 5 Improper Access Control Vulnerability (CVE-2026-40960)
2 rules 1 TTP 1 CVELuanti 5 before 5.15.2 allows unintended access to an insecure environment if a crafted mod intercepts requests when secure mods are enabled, potentially leading to unauthorized access and control.
Fastify Proxy Header Stripping Vulnerability
2 rules 2 TTPsThe `@fastify/reply-from` and `@fastify/http-proxy` libraries process the client's `Connection` header after adding headers, allowing attackers to strip proxy-added headers via the `Connection` header, leading to potential bypass of security controls.
ArgoCD Image Updater Namespace Bypass Vulnerability (CVE-2026-6388)
2 rules 1 TTP 1 CVECVE-2026-6388 describes a flaw in ArgoCD Image Updater that allows an attacker with permissions to create or modify an ImageUpdater resource in a multi-tenant environment to bypass namespace boundaries and trigger unauthorized image updates.
Barracuda RMM Privilege Escalation via Filesystem ACLs
2 rules 1 TTP 1 CVEBarracuda RMM versions prior to 2025.2.2 are vulnerable to local privilege escalation, allowing attackers to gain SYSTEM privileges by exploiting overly permissive filesystem ACLs on the C:\Windows\Automation directory.
GIMP GIF Image Buffer Overflow Vulnerability
2 rules 3 TTPs 1 CVEA buffer overflow vulnerability in the GIF image loading component of GIMP allows an attacker to write beyond an allocated buffer by processing a specially crafted GIF file, potentially leading to denial of service or arbitrary code execution.
Google Chrome Proxy Use-After-Free Vulnerability (CVE-2026-6297)
2 rules 1 TTP 1 CVECVE-2026-6297 is a critical use-after-free vulnerability in the Proxy component of Google Chrome before version 147.0.7727.101, enabling a privileged network attacker to potentially achieve sandbox escape via a crafted HTML page.
Fastify Body Schema Validation Bypass via Leading Space in Content-Type Header
2 rules 1 TTP 2 CVEsFastify v5.x is vulnerable to a body schema validation bypass, allowing attackers to circumvent request body validation by prepending a single space to the Content-Type header, potentially compromising data integrity and security constraints.
Weblate Path Traversal Vulnerability in ZIP Download Feature (CVE-2026-34242)
2 rules 2 TTPs 1 CVEWeblate versions before 5.17 are vulnerable to path traversal due to improper verification of downloaded files in the ZIP download feature, potentially allowing attackers to access files outside the intended repository.
Weblate Project Backup Vulnerability Leads to Potential Remote Code Execution (CVE-2026-33435)
2 rules 3 TTPs 1 CVEWeblate versions before 5.17 are susceptible to remote code execution due to unfiltered Git and Mercurial configuration files in project backups, potentially allowing attackers to execute arbitrary code under specific conditions.
Velociraptor Authentication Bypass via query() Plugin
2 rules 2 TTPs 1 CVEVelociraptor versions prior to 0.76.3 contain an authentication bypass vulnerability in the query() plugin, allowing authenticated users to access data from other organizations within the Velociraptor deployment, potentially leading to unauthorized data access and privilege escalation.
Git for Windows NTLM Hash Leak Vulnerability (CVE-2026-32631)
2 rules 1 TTP 1 CVEGit for Windows versions prior to 2.53.0.windows.3 are vulnerable to NTLM hash theft by attackers who can trick users into cloning malicious repositories or checking out malicious branches, leading to potential credential compromise.
WC Lovers WCFM Marketplace SQL Injection Vulnerability (CVE-2025-63029)
2 rules 1 TTP 1 CVE 1 IOCAn SQL Injection vulnerability, identified as CVE-2025-63029, exists in the WC Lovers WCFM Marketplace WordPress plugin up to version 3.7.1, potentially allowing attackers to execute arbitrary SQL queries.
Splunk MCP Server App Cleartext Credential Exposure (CVE-2026-20205)
2 rules 1 TTP 1 CVEA user with access to the `_internal` index or the `mcp_tool_admin` capability in Splunk MCP Server app versions below 1.0.3 can view user session and authorization tokens in clear text, leading to potential credential compromise.
Windows Hyper-V Improper Input Validation Vulnerability (CVE-2026-32149)
2 rules 2 TTPs 1 CVECVE-2026-32149 is a vulnerability in Windows Hyper-V due to improper input validation, which allows an authorized, local attacker to execute arbitrary code.
Windows Kerberos Improper Authorization Privilege Escalation (CVE-2026-27912)
2 rules 1 TTP 1 CVECVE-2026-27912 describes an improper authorization vulnerability in Windows Kerberos, enabling an attacker on an adjacent network with valid credentials to elevate privileges.
Windows LUAFV TOCTOU Vulnerability Allows Local Privilege Escalation (CVE-2026-27929)
2 rules 1 TTP 1 CVECVE-2026-27929 is a time-of-check time-of-use (TOCTOU) race condition in Windows LUAFV that allows an authorized local attacker to elevate privileges.
Windows Projected File System Race Condition Privilege Escalation (CVE-2026-27927)
2 rules 1 TTP 1 CVECVE-2026-27927 is a race condition vulnerability in the Windows Projected File System that allows an authorized attacker to escalate privileges locally.
Windows Push Notifications Race Condition Privilege Escalation (CVE-2026-26172)
2 rules 1 TTP 1 CVECVE-2026-26172 is a race condition vulnerability in Windows Push Notifications, allowing a locally authenticated attacker to elevate privileges.
Windows Push Notifications Race Condition Privilege Escalation (CVE-2026-32158)
2 rules 1 TTP 1 CVECVE-2026-32158 is a race condition vulnerability in Windows Push Notifications that allows an authorized attacker to elevate privileges locally due to improper synchronization when using shared resources.
Windows Push Notifications Race Condition Privilege Escalation (CVE-2026-32160)
2 rules 1 TTP 1 CVECVE-2026-32160 describes a race condition vulnerability in Windows Push Notifications that allows a locally authorized attacker to elevate privileges.
Windows Remote Desktop Spoofing Vulnerability (CVE-2026-26151)
2 rules 2 TTPs 1 CVECVE-2026-26151 is a spoofing vulnerability in Windows Remote Desktop due to an insufficient UI warning for dangerous operations, allowing an unauthorized attacker to perform spoofing over a network.
Windows SSDP Service Race Condition Privilege Escalation (CVE-2026-32068)
2 rules 1 TTP 1 CVECVE-2026-32068 is a race condition vulnerability in the Windows SSDP Service that allows an authorized attacker to elevate privileges locally.
Windows Storage Spaces Controller Out-of-Bounds Read Privilege Escalation (CVE-2026-32076)
2 rules 1 TTP 1 CVECVE-2026-32076 is an out-of-bounds read vulnerability in the Windows Storage Spaces Controller that allows an authorized local attacker to elevate privileges.
Windows TCP/IP Race Condition Vulnerability (CVE-2026-33827)
2 rules 2 TTPs 1 CVECVE-2026-33827 is a race condition vulnerability in Windows TCP/IP that allows an attacker to execute arbitrary code over the network by exploiting improper synchronization during concurrent execution using shared resources.
Windows User Interface Core Race Condition Privilege Escalation (CVE-2026-27911)
2 rules 1 TTP 1 CVECVE-2026-27911 is a race condition vulnerability in the Windows User Interface Core that allows a local attacker to elevate privileges due to improper synchronization when accessing shared resources.
Windows WalletService Use-After-Free Privilege Escalation (CVE-2026-32080)
2 rules 1 TTP 1 CVECVE-2026-32080 is a use-after-free vulnerability in the Windows WalletService, allowing a locally authorized attacker to elevate privileges.
Windows Win32K GRFX Privilege Escalation via Race Condition (CVE-2026-33104)
2 rules 1 TTP 1 CVECVE-2026-33104 is a race condition vulnerability in Windows Win32K - GRFX that allows an authorized local attacker to elevate privileges by exploiting concurrent execution using a shared resource with improper synchronization.
Windows WinSock Race Condition Privilege Escalation (CVE-2026-26173)
2 rules 1 TTP 1 CVECVE-2026-26173 is a race condition vulnerability in the Windows Ancillary Function Driver for WinSock that allows a local attacker to elevate privileges.
Windows WinSock Use-After-Free Privilege Escalation (CVE-2026-26177)
2 rules 1 TTP 1 CVECVE-2026-26177 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock, allowing a local attacker to elevate privileges.
Zarf Path Traversal Vulnerability via Malicious Package Metadata.Name
3 rules 1 TTPZarf is vulnerable to path traversal due to insufficient sanitization of the Metadata.Name field in package manifests when using the `zarf package inspect sbom` or `zarf package inspect documentation` commands, potentially leading to arbitrary file write.